As Consult Hyperion, and as many other analysts, predicted, Covid-19 has driven the adoption and use of contact-free technology at the point of service. A recent survey funded by the National Retail Foundation, found that no-touch payments have increased for 69 percent of US retailers surveyed, since January 2020. In May, Mastercard reported that 78% of all their transactions across Europe were contactless.
Fraudsters are always looking for ways to take advantage of potential weaknesses or even inexperience in new payment devices. A recent news story promoted a man in the middle attack in which two phones are used to transfer and manipulate the transaction message between a stolen contactless card and the point of sale terminal.
At Consult Hyperion, we have already seen the pandemic accelerate the adoption of contact-free payments in the face to face environment as customers have become wary of catching COVID by touching shared devices, such as self-service terminals and PIN pads. The use of personal devices for payments is hardly new but the attraction of an in-app/in-store version of mobile payments, whereby the consumer uses an app on their own device to interact with the retailer or service provider and pay for services, has just increased dramatically. Solutions for parking (RingGo) and for restaurants (like the Wahaca app, powered by Judopay) were already demonstrating the benefits of such an approach for customers and businesses before COVID struck.
It feels strange to be writing about paying for food, one of
the basic skills we learn in early childhood. However, these are exceptional
times, when the basic notion of how we pay is being challenged. It seems we are
now considering the different options for paying safely when physical contact
must be kept to a minimum.
Consult Hyperion has been alerted to many requests for advice from community groups who normally rely on cash payments, so in response we have drawn up some guiding principles:
1. Maintain good practice: be aware of the vulnerability, both real and perceived, of people unable to leave their homes. Asking them to do things differently risks increasing anxiety and leaving them open to fraud.
2. Keep it simple: work with payments options people already use, and those they are familiar with. The large spike in phishing attacks over the past month highlights scammers’ eagerness to abuse this situation.
3. Maintain records: clear and consistent transaction logging is essential to protect both organisers and the people they are helping. Keep invoices for tracking and reconciliation purposes.
4. Work with existing networks: local authorities, housing associations, care providers, charities, community groups, faith groups, even village shops. The mix will vary according to the community.
5. Only allow demonstrably trustworthy individuals to handle payments: the list of people permitted to countersign passport applications could be a good starting point, but each community is different. Trust is vital in payments.
6. Keep payments and shopping separate: older readers will remember having an account with their local shop and having items added to their tally, paying the bill weekly or monthly.
7. School meals provide a good example: cards (or biometrics) are used to ensure all students have equal access to food, without the stigma attached with free school meals. Food is still served, even if the system has technical issues.
8. Take the time to discuss people’s preferences over the phone: The person receiving the shopping doesn’t have to be the person who pays. Be creative in encouraging people to contribute a little extra, or allow friends and family to pay on their behalf.
When organising payments, only use options people already have. This is not the time for a stressful sign-up process. In order of preference:
Online – PayPal, Bank Transfer, Pingit
With any new online payment, if there is a level of trust
through an existing relationship, ask the account holder to send a small sum of
1p or 10p to the intended account, to check that it does arrive in the right
place.
PayPal: convenient if you already have an account.
Allows you to choose different sources of funds to transfer. Can be used for
paying individuals as well as organisations. Includes a degree of protection.
Bank transfer (frequently referred to as Faster Payments):
Despite communication from many of our banks, the full roll out of Confirmation
of Payee is delayed. There is uncertainty over whether the money will arrive in
the right place, so test initially with small amounts. It is irreversible. It can
be performed easily via internet banking if you have the capability. Telephone
banking is currently overloaded.
Some apps enable an invoice with bank details to be
presented through a link to web page. This is better than simply sending
requests for payments within an email, as fraudsters can’t just intercept the
email and change the recipient details. It requires more effort to set up a
fraud and is more likely to get spotted.
Pingit: Less widespread but convenient person-to-person payments which can be sent to a mobile number.
Contactless at the door
Using a portable reader from companies like iZettle, SumUp and Square. Apple Pay and Google Pay are good options as they allow higher value payments without the need to touch the device, if people already have the capability. Appropriate distancing must be observed.
Cheques
The householder only has to part with a single piece of paper and does not have to receive change. Cheques will have to be paid in and take a while to clear but there is very little risk of the householder absconding.
Cash
People are encouraged to avoid handling cash and avoid
touching ATMs. Keeping cash in the home makes people more vulnerable. However,
some people rely on cash. Where change is to be given, this should be arranged
in advance and put in an envelope.
These are extraordinary times, which force us to look differently at the way we pay. Consult Hyperion have been enabling secure payments for over 30 years and we are able to apply our own Structured Risk Analysis process to understand the threats and possible countermeasures in every situation. These threats normally relate to the security of systems but in this case also encompass the risk of infection and people being left without essential supplies.
Finally
If you are reading this from home and need help, try phoning your local shop. If they are not organising deliveries themselves, they may well be aware of groups who are. Many local stores and community groups are providing help to these who need it, providing a much needed service. Get in touch with your local group.
In these extraordinary times with the need for social distancing, the payments industry is raising the contactless limits across many countries in order to prevent the need to touch PIN Pads in order to pay for our essential supermarket and pharmacy shopping. Indeed, such is the concern over the use of cash that contactless payments are being actively encouraged over cash, with some countries, notably China and Russia[1] now requiring that cash is sanitised before it is allowed back into circulation.
The Dutch Payment Association[2] has moved to double their contactless CVM limit from €50 to €100, similar increases are being introduced by Poland; Norway; Canada; Turkey etc. Yesterday the British Retail Consortium[3] announced that the UK too will raise its contactless limit from £30 to £45 on the 1st April.
So why do we need to wait a week? What does it mean? What
are the alternatives?
First let us explain how contactless limits work and
understand the difference between contactless payments in the UK compared to
most other countries. Contactless
payment terminals have 3 limits:
Floor Limit
CVM Limit
Transaction Limit
The Floor Limit determines if the transaction should be sent online to the Issuing bank for authorisation. In the UK the contactless floor limit has been set at £0 for some time, ensuring all transactions are sent online, preventing spend from any cards that have been reported lost or stolen.
The CVM Limit is the one which is being changed on the 1st April. Above the CVM Limit a transaction requires a cardholder PIN or biometric authentication in order to be approved, which generally means a Chip & PIN transaction is needed. We are now seeing the introduction of some biometric contactless cards, but there are very few of them in the market today. By raising the CVM limit to £45 any contactless transactions below this will be sent to the Issuer for authorisation, which should result in the need to touch the POS less by reducing the number of Chip & PIN transactions.
In the UK, the Transaction Limit has not been uniformly
implemented, in some merchants it is set to the same as the CVM Limit, meaning
contactless can only happen below £30. The result has been confusion over when
Apple Pay and Google Pay transactions will work and when you need to perform
Chip & PIN. POS providers and
merchants need to take the opportunity of this limit change to test their
systems to ensure that both the CVM Limit and the Transaction Limit are set
appropriately to provide the maximum opportunity to pay by contactless.
As my fellow Principal Consultant Tim Richards points out in our video blog, other countries are using mobile apps to prevent the need for PIN – completely “Contact Free” transactions. We don’t have that capability in the UK yet, Apple Pay and Google Pay being the best options for now. We expect this to change as Open Banking progresses and payments without the need for PIN become more common.
Consult Hyperion have extensive experience in contactless
and “Contact Free” payments and testing, we will be able to help organisations ensure
they optimise their payments capability to meet the needs of their customers,
get in touch for more information on how we can help.
In the meantime, to avoid PIN Pads, shop below £45 or ensure Apple Pay or Google Pay is working on your mobile device, and stay safe.
At Consult Hyperion we take a certain amount of enjoyment looking back over
some of our most interesting projects around the world over the previous year
or so, wrapping up thoughts on what we’re hearing in the market and spending
some time thinking about the future. Each year we consolidate the themes and
bring together our Live Five.
2020 is upon us and so it’s time for some more future gazing! Now, as in previous years, how can you pay any attention to our prognostications without first reviewing our previous attempts? In 2017 we highlighted regtech and PSD2, 2018 was open banking and conversational commerce, and for 2019 it was secure customer authentication and digital wallets — so we’re a pretty good weathervane for the secure transactions’ world! Now, let’s turn to what we see for this coming year.
Hello 2020
Our Live Five has once again been put together with particular regard to the
views of our clients. They are telling us that over the next 12 months
retailers, banks, regulators and their suppliers will focus on privacy as a
proposition, customer intimacy driven by hyper-personalisation and personalized
payment options, underpinned by a focus on cyber-resilience. In the background,
they want to do what they can to reduce their impact on the global environment.
For our transit clients, there will be a particular focus on bringing these
threads together to reduce congestion through flexible fare collection.
So here we go…
1. This year will see privacy as a consumer proposition. This is an easy prediction to make, because serious players are going to push it. We already see this happening with “Sign in with Apple” and more services in this mould are sure to follow. Until quite recently privacy was a hygiene factor that belonged in the “back office”. But with increasing industry and consumer concerns about privacy, regulatory drivers such as GDPR and the potential for a backlash against services that are seen to abuse personal data, privacy will be an integral part of new services. As part of this we expect to see organisations that collect large amounts of personal data looking at ways to monetise this trend by shifting to attribute exchange and anonymised data analytics. Banks are an obvious candidate for this type of innovation, but not the only one – one of our biggest privacy projects is for a mass transit operator, concerned by the amount of additional personal information they are able to collect on travellers as they migrate towards the acceptance of contactless payment cards at the faregate.
2. Underpinning all of this is the urgent need to address cyber-resilience. Not a week goes by without news of some breach or failure by a major organisation putting consumer data and transactions at risk. With the advent of data protection regulations such as GDPR, these issues are major threats to the stability and profitability of companies in all sectors. The first step to addressing this is to identify the threats and vulnerabilities in existing systems before deciding how and where to invest in countermeasures.
Our Structured Risk Analysis (SRA) process is designed to help our customers through this process to ensure that they are prepared for the potential issues that could undermine their businesses.
3. Privacy and Open Data, if correctly implemented and trusted by the consumer, will facilitate the hyper-personalisation of services, which in turn will drive customer intimacy. Many of us are familiar with Google telling us how long it will take us to get home, or to the gym, as we leave the office. Fewer of us will have experienced the pleasure of being pushed new financing options by the first round of Open Banking Fintechs, aimed at helping entrepreneurs to better manage their start-up’s finances.
We have already demonstrated to our clients that it is possible to use new technology in interesting ways to deliver hyper-personalisation in a privacy-enhancing way. Many of these depend on the standardization of Premium Open Banking API’s, i.e. API’s that extend the data shared by banks beyond that required by the regulators, into areas that can generate additional revenue for the bank. We expect to see the emergence of new lending and insurance services, linked to your current financial circumstances, at the point of service, similar to those provided by Klarna.
4. One particular area where personalisation will have immediate impact is giving consumers personalised payment options with new technologies being deployed, such as EMV’s Secure Remote Commerce (SRC) and W3C’s payment request API. Today, most payment solutions are based around payment cards but increasingly we will see direct to account (D2A) payment options such as the PSD2 payment APIs. Cards themselves will increasingly disappear to be replaced by tokenized equivalents which can be deployed with enhanced security to a wide range of form factors – watches, smartphones, IoT devices, etc. The availability of D2A and tokenized solutions will vastly expand the range of payment options available to consumers who will be able to choose the option most suitable for them in specific circumstances. Increasingly we expect to see the awkwardness and friction of the end of purchase payment disappear, as consumers select the payment methods that offer them the maximum convenience for the maximum reward. Real-time, cross-border settlement will power the ability to make many of our commerce transactions completely transparent. Many merchants are confused by the plethora of new payment services and are uncertain about which will bring them more customers and therefore which they should support. Traditionally they have turned to the processors for such advice, but mergers in this field are not necessarily leading to clear direction.
We know how to strategise, design and implement the new payment options to deliver value to all of the stakeholders and our track record in helping global clients to deliver population-scale solutions is a testament to our expertise and experience in this field.
5. In the transit sector, we can see how all of the issues come together. New pay-as-you-go systems based upon cards continue to rollout around the world. The leading edge of Automated Fare Collection (AFC) is however advancing. How a traveller chooses to identify himself, and how he chooses to pay are, in principle, different decisions and we expect to see more flexibility. Reducing congestion and improving air quality are of concern globally; best addressed by providing door-to-door journeys without reliance on private internal combustion engines. This will only prove popular when ultra-convenient. That means that payment for a whole journey (or collection or journeys) involving, say, bike/ride share, tram and train, must be frictionless and support the young, old and in-between alike.
Moving people on to public transport by making it simple and convenient to pay is how we will help people to take practical steps towards sustainability.
So, there we go. Privacy-enhanced resilient infrastructure will deliver hyper-personalisation and give customers more safe payment choices. AFC will use this infrastructure to both deliver value and help the environment to the great benefit of all of us. It’s an exciting year ahead in our field!
It didn’t get much of a fanfare, but the new iPhones have an interesting new
technology in them. It’s called Ultra Wideband, or UWB, and it’s in
the iPhone 11, iPhone 11 Pro and
iPhone 11 Pro Max. It’s a technology used for some very
interesting location-based applications. To give just one example, NFL
players have UWB transmitters in each shoulder pad, part of broadcast
technology used for instant replay animations. A football’s location is updated
2,000 times per second.
Anyway, it’s in my iPhone now and it will be showing up in Android phones
later this year. If you look on the Apple web site, you’ll see the arrival of
UWB confirmed with the interesting caveat that “availability
varies by region”.
(The reason for this is that UWB is subject to national regulatory
requirements that require it to be turned
off in certain locations such as, to give one example, Vietnam.)
It’s not really a new technology as it’s been around for ages. The spectrum
was opened up for commercial use in 2005 by the FCC for pulse-based
transmission in the 3.1 to 10.6 GHz range and the IEEE (Institute of Electrical
and Electronic Engineers) standard on UWB (802.15.4)
came out more than a decade ago. The idea behind it was to send data by
transmitting short, low-power radio pulses across a wide spectrum (the channels
are ten times wider than the channels used for wifi). The data is encoded so
that each bit is spread 32-128 of the nanosecond radio pulses so that you can
send lots of data (say 10Mb/s) with little interference.
UWB was one of a family of wireless protocols, along with Bluetooth,
ZigBee and WiFi, intended for short-range wireless communications with low
power consumption. Back in the day it was assumed that, broadly speaking,
Bluetooth was for a cordless keyboards and hands-free headset, ZigBee was for
monitoring and control networks, while Wi-Fi was for computer-to-computer
connections to substitute for wired networks and UWB was for high-bandwidth
multimedia link. It never really caught on though. WiFi worked well enough
and got faster, it got built in to laptops and phones and together with
Bluetooth seemed to take care of most applications.
But then came the pivot.
It turned out that people found another use for UWB, because these
nanosecond radio pulses have an interesting characteristic. They
allow you to determine location with great accuracy. The short bursts
of signals with their sharp rises and drops mean that the signal start and stop
are inherently easier to measure than for wifi or Bluetooth transmissions. This
means that the distance between two UWB devices can be measured precisely by
measuring the time that it takes for a radio wave to pass between the two
devices. It
delivers much more precise distance measurement than signal-strength estimation
and, what’s more, UWB signals maintain their integrity in the presence of
noise and multi-path effects.
All of which means that with UWB it is possible to measure the time it takes
the signal to travel from transmitter to receiver and calculate the distance in
centimetres, giving much better distance information than determining distance
based iBeacons and such like. Apps can therefore receive precise location data
and location updates can be delivered every 100 ms if necessary. So
UWB-equipped devices can determine the precise location of another UWB device
and know whether it’s stationary, approaching or receding. For example, a UWB-enabled system
can sense if you’re moving toward a locked door and it can know if you’re
on the inside or outside of the doorway, to determine if the lock should remain
closed or open when you reach a certain point.
So if you have a UWB phone and a UWB tag of some kind, then the phone can
work out where the tag is. Now, I already use something like this, because I’m
a big fan of Tile.
If you haven’t used Tile, it’s an app on your phone that can locate Bluetooth
tags. You buy these tags and then attach them to things (I’ve got one on my
keys, one in my wallet and one in my notebook) so that you can find them. I
can’t tell you how many times — maybe this is something to do with age — that
I’ve misplaced my keys and saved hours of searching around the house by using
the app.
Anyway, for the moment Apple only uses UWB to connect its own devices but
there are standardisation efforts underway to interconnect devices from different
manufacturers. An example use case (where
Apple already has patents) is for keyless car unlocking.
(Apple is a charter member of the Car Connectivity Consortium, which created
the Digital Key Release 1.0 specification in 2018.)
Pretty cool stuff! So if you are thinking about a fun payments skunkworks
project, you might do worse than have a look at what UWB can do to transform
your customers’ experiences at point-of-sale and then ask the Hyperlab team at
Consult Hyperion to help you to put something together.
This article
was originally published on Money20/20.
We are in the midst of seismic societal
changes of how people interact and transact. Across societies,
geographies and segments, digital is the new norm. Change has accelerated,
placing greater value upon flexibility and speed. Historically, money and
finance have been among the more conservative and slower changing parts of
society, but this has changed dramatically over the past decade by viewing
money as an instigator of change rather than a lagging indicator.
Whether you are a marketer in shining armor
conquering new territory, a financial wizard casting spells upon the balance
sheet, or the queen or king guiding the whole enterprise, here are 4 trends
about money that you should keep in mind for your business.
Platforms are the new kingdoms
Platforms are the base upon which other
structures can be built. For example, App stores from Apple and Google
provide the infrastructure for consumers to complete commercial transactions
and manage finances through their mobile phones. While these companies
develop their own digital wallets, they also enable similar services from
banks, retailers and other companies. Building and maintaining the
platform enables services that they would not have created on their own, like
Uber or Lyft, which in turn, have created their own platforms.
Marketers trying to address customers’ needs
can plug into platforms to broaden offerings or deepen engagement with target
markets. Platform-based thinking implies that product and service design is
ongoing and doesn’t stop with a product launch. Jack Dorsey didn’t stop
when he built the Square credit card reader. The team went into lending
with Square Capital. They got into consumer P2P payments with Square
Cash. Their ecosystem has grown through partnerships with other companies
as well as in-house development.
Digital Identities open the gates
How do your customers interact with you?
Do they need to create a username and password, or can they use a 3rd
party system like Google or Facebook? Are security services like
two-factor authentication or biometrics used to protect credentials? Is
your company protecting customer identities adequately? The importance of
all of these questions is increasing and often the difference between being
forced into early retirement by a massive data breach or surviving to continue
to grow your business.
While identity management and digital
security might not be top of mind for most marketers, they are table stakes for
even the most basic future business. History is full of tales of rulers
successfully fighting off armies laying sieges on castles and fortresses, only
to fail when another army gets access to a key for the back door.
Context rules the experience
Credit card transactions moved from
predominantly being in-store, to e-commerce sites accessed from desktop
computers, and now to mobile phones. As the point-of-purchase expanded,
so did the consumer use cases and thought processes. In tandem, mobile screens
presents less information than desktop computer screens, which in turn presents
less information than associates in a brick-and-mortar environment.
Companies best able to understand context and deliver the right user
experience within these constraints will build loyal customer relationships.
Apps or services created for a different
use cases on the same platform, such as Facebook and Messenger apps, can help
achieve this. Banks and have different apps for managing accounts or for
completing transactions or payments. On a desktop, you can access these
services through a single interface but on the mobile, forcing users to select
their use case helps present a streamlined experience on the smaller, more
time-constrained mobile screen. The use of additional data such as
location, device, etc. can further streamline the experience. Marketers that
don’t think about the context will lose the battle before it even begins.
Data is gold
While a marketer’s goal is to generate
sales, data has become a value driver. In the financial world, data about
payments, assets and liabilities has become critical in how products and
services are delivered. PayPal, a fintech that began even before the word
‘fintech’, has recently been using payments data from their platform to help
build a lending business for their customers. Similarly, an SME lender
named Kabbage has grown to unicorn status by using data from other sources to
make smarter lending and pricing decisions. In the payments industry,
Stripe distilled a previously complex technology integration into a minimal
data set, accessed via API, to easily build payments into new digital products
and services.
Those that are able to harness the power of
data will be able to predict what customers want and more effectively address
their needs. In some cases, it might be using data from within your
enterprise or from other platforms for targeting, pricing or servicing
decisions. In other cases, it might be using data to reimagine what your
product or service is.
Looking for more insights on key trends in
money? Hear from 400+ industry leaders at Money20/20 USA. Money20/20 USA will
be held on October 27-30, 2019 at The Venetian Las Vegas. To learn more and
attend visit us.money2020.com.
The EBA’s recent Opinion on the elements of strong customer
authentication under PSD2 was, apart from moving the goalposts on when SCA will
be enforced, full of interesting information about what constitutes a valid SCA
element. It closes some doors, opens others and ends any notion that merchants
can take liability and not do SCA themselves.
Taking the final point first, there’s been a view that Article 74(2) of PSD2 permits merchants to carry on without implementing SCA as long as they take liability. We at Consult Hyperion have long argued that that is an optimistic and overly legalistic reading of the regulations and this has now been confirmed. The EBA states:
In addition, even if there were a liability shift to the payee or the payee’s PSP for failing to accept SCA, as articulated in Article74(2) of PSD2, this could not be considered an alleviation of PSPs’ obligation to apply SCA in accordance with and as specified in Article 97 of PSD2.
Basically, Article 97 takes precedence – PSPs (aka Issuers)
must apply SCA so if the merchant chooses not to then rather than end up with a
payment for which they’re liable they’ll end up with no payment at all. Which,
you’d imagine, would rather miss the point of being a merchant.
Beyond this point the Opinion has lots of interest to say
about inherence, possession and knowledge elements.
On inherence two points stand out. Firstly the
Opinion unambiguously states that behavioural biometrics can be a valid factor:
this opens up a world of possible low friction SCA, and we expect to see lots
of innovation in this area. Secondly it states that 3DS-2 does not support
inherence as none of the data points being gathered relate to biological or
behavioural biometrics but – and we view this as important – 3DS-2 is a valid
means of supporting SCA.
This is critical because the dynamic linking process behind
3DS-2 is not straightforward and there have been differences of opinion over
whether this is compliant. Given that 3DS-2 appears to be the only game in town
for CNP transactions having a statement that it’s OK is mighty important.
On possession, the EBA clarifies that OTP SMS is
valid and also that mobile app based approaches can be – but only if the app is
linked to the device. We’ve been arguing that this is obviously the case for a
while, so it’s good to see this confirmed: although there are going to be a few
app developers out there that need to revise their approaches pdq (we can help,
of course!).
Also on possession the EBA has stated something that really
should have been obvious to anyone taking more than a moderate interest in the
topic – printed card details such as PAN and CVV or user ids and email
addresses are not valid possession or knowledge elements. As a number of
prominent industry players have been taking the opposite approach this could
lead to some interesting developments in the coming weeks, particularly as the
Opinion states that if the CVV is not printed on the card and is instead sent
on a separate channel, then it is a valid knowledge element.
Overall, the analysis and discussion in the Opinion on valid
SCA elements is welcome, if a trifle tardy. To be fair to the EBA, we don’t see
anything in their analysis that a proper reading of the RTS wouldn’t have
produced. However, it’s been clear for some time that many industry players
have been making a highly liberal interpretation of the requirements usually
based on a legal opinion. But PSD2 and the RTS are about principles, not rules:
if you need advice on this you need to talk to the people who understand this
stuff. Which, by the way, is us, not law firms.
The reasons behind the presence of mag stripe on cards alongside chip (and PIN) has long been a debate at Consult Hyperion. Especially for the US where things were different for years – of course now the US has introduced chip and PIN as well.
But putting
numbers and signatures on cards helps criminals. There’s no need for it.
A couple of years later, in “Tired: Banks that store money. Wired: Banks that store identity” we asked why banks didn’t put a token in Apple Pay that didn’t disclose the name or personal information of the holder, a “stealth card” that could be used to buy adult services online using the new Safari in-browser Apple Pay experience. This would be a simple win-win: good for the merchants as it would remove CNP fraud and good for the customers as it would prevent the next Ashley-Madison catastrophe. Keep my real identity safe in the vault, give the customer a blank card to go shopping with.
Brazil Nuts
Some years ago, we were testing Static Data Authentication (SDA) “chip and PIN” cards in the UK, we used to make our own EMV cards. To do this, we took valid card data and loaded it onto our own Java cards. These are what we in the business call “white plastic”, because they are a white plastic card with a chip on it but otherwise completely blank. Since our white plastic do-it-yourself EMV cards could not generate the correct cryptogram (because you can’t get the necessary key out of the chip on the real card, which is why you can’t make clones of EMV cards), we just set the cryptogram value to be “SDA ANTICS” or whatever (in hex). Now, if the card issuer is checking the cryptograms properly, they will spot the invalid cryptogram and reject the transaction. But if they are not checking the cryptograms, then the transaction will go through.
You might call
these cards pseudo-clones. They acted like clones in that they worked correctly
in the terminals, but they were not real clones. They didn’t have the right
keys inside them. Naturally, if you made one of these pseudo-clones, you didn’t
want to be bothered with PIN management so you made it into a “yes card” –
instead of programming the chip to check that the correct PIN is entered, you
programmed it to respond “yes” to whatever PIN is entered. We used these
pseudo-clone cards in a number of shops in Guildford as part of our testing
processes to make sure that issuers were checking the cryptograms properly. Not
once did any of the Guildford shopkeepers bat an eyelid about us putting these
strange blank white cards into their terminals. Of course it’s worth noting
things have progressed and fortunately this wouldn’t work now as the schemes
have moved on from SDA.
I heard a different story from a Brazilian contact. He discovered that a Brazilian bank was issuing SDA cards and he wanted to find out whether the bank was actually checking cryptograms properly (they weren’t). In order to determine this, he made a similar white plastic pseudo-clone card and went into a shop to try it out.
When he put
the completely white card into the terminal, the Brazilian shopkeeper stopped
him and asked him what he was doing and what this completely blank white card
was, clearly suspecting some misbehaviour.
The guy,
thinking quickly, told him that it was one of the new Apple credit cards!
“Cool” said the shopkeeper, “How can I get one?”.
Titanium Dreams
That Brazil
story was written back
in 2014! There was no white Apple credit card at that time but it
was interesting that the shopkeeper expected an Apple credit card to be all
white and with no personal data on display, just as we had suggested in our
ancient ruminations on card security. Imagine the total lack of surprise when
the internet tubes delivered the news of the new actual Apple credit card
launched in California a couple of weeks ago. Apple CEO Tim Cook said that
the new Apple Card would be the biggest card innovation “in 50 years” [FT].
This seems a little rough on the magnetic stripe, online authorisation,
chip and PIN, debit cards, contactless interfaces and so on, but it is
certainly an interesting development for people like us at Consult
Hyperion.
The story
gathered the usual media interest. A number of reports on the web reporting on
“Apple going into banking” which, obviously, they are not. Far from it. The
Apple Card issuer is Goldman Sachs (it’s their first credit card product) and
the card product is wholly unremarkable. The card looks pretty cool though, no
doubt about that. I still don’t know why they put the cardholder name on the
front (instead of their Apple ID).
Apple Card is launching into an interesting environment. The US POS is a confusing place but Apple know their stuff and I am sure that they think they can use the 2% cash back on ApplePay purchases vs. the 1% on chip/stripe to push people toward the habit of using their phones at POS instead of cards. Judging by the sign I saw in an Austin gas station, they may be right.
The Apple Card adds security, there’s no doubt about that. The card-not-present PAN and CVV displayed by the app (which can be refreshed) are not the same as the PAN and CVV on the stripe, so you can’t make counterfeit stripe cards with data from the app and Apple uses the Mastercard token Account Update service, so if you give (say) Spotify the CNP PAN/CVV and then refresh it, you don’t need to tell Spotify that you’ve changed anything because Mastercard will sort it out with Spotify. That’s security for the infrastructure and convenience for the customer.
Now You See It
While I was jotting down some notes about Apple Card, I was thinking about David Kwong, the illusionist. He gave an entertaining talk at Know 2019 in Las Vegas and I was privileged to MC his session. I was sitting feet away from him and I couldn’t figure out how he did it. That’s because he is a master of misdirection!
I can’t help
feeling that there’s a bit of misdirection going on with Apple Card. The press
are reporting about the card product, but it’s really not that earth
shattering. It seems to me that what is really important in the
announcement isn’t extending Goldman Sachs’ consumer credit business or that
bribe to persuade apparently reluctant consumers to use Apple Pay at
contactless terminals instead of swiping their card, but the attempt to get
people to use Apple Cash. Cognisant of how Starbucks makes out by persuading
citizens to exchange their US dollars that are good anywhere into Starbucks
Dollars that are not, and of Facebook’s likely launch of some kind of Facebook
Money, Apple are hoping to kick-start an Apple Cash ecosystem.
You may have
noticed that as of now, you can no longer fund person-to-person Apple
payments (in Messages) using
a credit card. You can still fund your Apple Cash via a debit card.
You can pay out from your Apple Cash to a Visa debit card for a 1% fee or via
ACH to a bank account for free. They want to reduce the costs of getting volume
into Apple Cash and make it possible for you to get it out with jumping through
hoops. Given that you can do this, you’ll be more relaxed about holding an
Apple Cash balance and that means that next time you go to buy a game or a song
or whatever, Apple can knock it off of your Apple Cash balance rather than
feeding transactions through the card rails.
And why not?
In this ecosystem Apple would carry the float, which might well run into
millions of dollars (Starbucks’ float is over a billion dollars), and if it
could persuade consumers to fund app, music and movie purchases from Apple Cash
instead of cards it would not only save money, but anchor an ecosystem that
could become valuable to third-party providers as well. With Facebook’s
electronic money play on the horizon, I think Apple are making a play not for a
new kind of card to compete with my Amex Platinum and my John Lewis MasterCard
but for a new kind of money to compete with BezosBucks, ZuckDollas an Google
Groats.
I was a panellist discussing the barriers to mobility as a service (MaaS) at the Transport Ticketing Global (TTG19) conference in London in January. In fact, many of the presentations over the two-day conference were about MaaS and reasons why it is proving very hard to deliver. Perhaps one of the most mature MaaS offerings is the one from MaaS Global branded as ‘Whim’ which launched in the UK in the West Midlands but, by their own admission, has struggled to gain a foothold.
Until recently, MaaS providers have avoided London. We have seen some excellent journey planning apps exploiting Transport for London’s (TfL) open APIs, but nobody was going that extra mile and actually proving a complete MaaS solution in a single app that allow both planning journeys together with payment and ticketing (i.e. proving authority to travel when entering the transit network). TfL has been very clear that they will not provide any cut of the fares to MaaS providers, so they will have to find other ways to make a profit.
So, the announcement from CityMapper that they are about to launch a MaaS solution in London surely doesn’t make any sense? Given the above barriers to MaaS and the high complexity of London’s public transport network, why on earth would you start there?
The answer is payments and identity, two of our favourite topics. These are services needed in order to offer account-based ticketing (ABT) and ABT is a corner-stone of MaaS. Passengers need to identify themselves to their customer account so that their journey charges can be calculated. Payment for the journeys needs to be handled in a way that is suitable to the particular customer.
One of the barriers I suggested on the TTG19 panel is that payment and identity are too ‘closely coupled’ in modern account-based ticketing offerings. I am old enough to remember the emergence of service oriented architectures in the ‘noughties’. The idea was that by ensuring services are ‘loosely coupled’, they can freely evolve without affecting consumers or implementations. I argued that if everyone rushes to implement the open-loop payment models with the payment networks like TfL has done, then we will be left with fare collection services that are highly dependent on the payment schemes and constrained from evolution. The identifier the passenger uses at the gate is their bank card (or its emulation on mobile or wearable devices). This identifies them to their ABT travel account but it also identifies their means of payment. Some would say this is convenient, I am suggesting it is too closely coupled and will stifle innovation.
Open banking APIs are a subject close to our hearts at the moment. The APIs are very new and they seem not to be thinking about transit payments at this stage. However, one could imagine that there could be future open banking APIs that would allow passengers to consent to transit payments from their bank to their MaaS provider without the need for the payment networks in between. I expect this will be subject of future blogs or white papers from Chyp.
The reason CityMapper is launching in London is that all the public transport modes accept open-loop payments and the CityMapper solution to payments and identity is to provide their MaaS customers with a Mastercard-branded prepaid card, ‘Pass’. CityMapper will offer a subscription model at a discount on TfL prices and any travel on TfL modes outside of this will simply use the prepaid bank card like any other.
This works for all London public transport modes, but there are very few other cities that have committed so totally to the open-loop models. It will be interesting to see whether CityMapper can make a profit and if they do, whether they can replicate it outside of London. Right now, it looks like they are using investment funding and planning on taking a loss to start with since they are offering to undercut the TfL fares and as stated above TfL has said they will not offer discounts to Maas providers. Or perhaps city mapper is planning on selling advertising space or plans to sell anonymised travel data to make up the shortfall? Only time will tell.
Meanwhile, may all your transit tokens be loosely coupled and your payment instruments plentiful.
Subscribe to our newsletter
You have successfully subscribed to the newsletter
There was an error while trying to send your request. Please try again.
