Tag: digital money electronic money mobile payments e-payment m-payment

Bid and offer

5th April 2011by Consult HyperionLeave a comment

There was an involved discussion about convergence of transaction platforms on a project that I am involved with and it set me thinking about what convergence actually means in this space and what the impact of that convergence might be. I started by remembering something that I’d read at Payments Views.

A couple of weeks ago, eBay held an Analyst Day where eBay senior management shared their thinking about the future of the changing commerce landscape – and how they’re thinking about taking the “e” out of eCommerce… What’s this taking out the “e” business all about? It’s about the influence of mobile on integrating online and offline commerce together.
[From The PayPal Juggernaut — Payments Views from Glenbrook Partners]

Scott is typically accurate with his comments hereafter. The strategic direction is convergence. Not the simplistic kind of convergence, where our mobile phones become watches, cameras, wallets and devices for getting stones out of horses hooves. This simply hasn’t happened. Sometimes I use my iPhone, sometime my iPhone, sometimes my MacBook Pro, sometimes my MacBook Air, sometimes my Apple TV (spot a bit of a theme here?) and sometimes I still walk into a store to buy things. The point is that the strategic direction of transactions is convergence so that whichever of these channels I use, I use the same digital money and digital identity infrastructure. It’s the transactions that become integrated, not the devices. And by integrating across channels, the transaction systems give me a better service, whether in terms of loyalty, fraud protection, price or whatever. I then continued by remembering a good report on e-payments that I’d read a couple of months ago.

A new O’Reilly/PayPal report on web-native payment platforms, “ePayments: Emerging Platforms, Embracing Mobile and Confronting Identity,” is now available for download. Among the topics covered in the report are the rise of payment platforms, the mobilization of money, and the advent of contactless payment in mobile commerce.
[From 3 mobile payment products hint at the future – O’Reilly Radar]

The thought experiment in the O’Reilly Radar “report about auctioning payments set me thinking. The idea is that, rather as advertising networks such as DoubleClick auction page impressions to advertisers in real-time (when you click on a page, the advertising network sends the details to advertisers who get 20 milliseconds to respond with a bid, and then the advertisement from the highest bidder is displayed) so when you click on “pay”, the payment platform might bundle together some facts about the transaction and auction them to processors. Presumably, one of the key elements in the bid decision would be related to fraud, especially if the pricing for the fraud management is unbundled from the pricing for the transaction itself and any other value-added services.

If this analysis is correct, then there will be a premium on identity and authentication because the higher the standard of identification that can be provided to the processors, the lower the bid! This would mean – to continue the thought experiment – that we would have a very accurate means of pricing identities. I imagine that this accurate pricing would reveal at least two interesting things. First of all, whether an identity is “real” or not is immaterial to the price, because the price will be based mainly on reputation (ie, transaction history). Secondly, the strength of the authentication will be directly reflected in price but for smaller transactions the price increments from 2FA to 3FA will be minimal. Thus, pricing will point towards pseudonymous 2FA as the “sweet spot” for transactional identities. So far, so good. Can we use this analysis to make some predictions about who might be best-placed to take advantage of this converged platform then? Well, last year I read that (all other things being equal) then it really should be the mobile operators. Qualcomm call these “horizontal models” for mobile operator value-added services – what I would call the “smart pipe” future of the mobile operator – and say that if operators do make a play in delivering intelligent services now, the potential upsides are great because…

They will strategically position themselves as a valued service provider to their subscribers – getting the retail experience right on mobile will be critical to capturing value;

They can act as an honest broker – trusted, secure, in their interests to protect and cater to their users’ needs;

They stand to gain from the uptick in usage as well as providing services using their billing platforms and the knowledge of their subscribers;

The potential of data analytics to turn digital footprints into value for consumers, MNOs and other players that have been cited in the two sided business model begins to emerge.

Vertical models may have created the marketplace, but Qualcomm believes a retailing experience that is not tied to any one operating system or technology is necessary for the industry to scale.
[From Mobile Internet: Horizontal Platforms Needed (Guest Post, Qualcomm) – Convergence Conversation]

I think this is broadly correct — especially the part about the honest broker, protecting the “real” identity of the consumers — and I think it means that operators must be more aggressive about their digital identity infrastructure as well as their digital money infrastructure. After all, who has this “retailing experience that is not tied to any one operating system”? The mobile operators do, but so does Apple. On the other hand, the mobile operators have a direct billing relationship with customers (and they know where they are). It’s time for the operators to start talking to processors about creating the mobile transaction auction house.

“We already have a perfectly fine way to make non-cash payments”

2nd April 2011by Consult Hyperion3 Comments

On “Slate” there was an article entitled “Paying With Your Phone Is Awesome, Because … Because” with a sub-headline

We already have a perfectly fine way to make non-cash payments.
[From Paying by phone is insecure and unnecessary. – By Farhad Manjoo – Slate Magazine]

Really? That didn’t seem to be the case in my household this morning when my wife was hunting for the chequebook because she needed to pay for a school trip and settle a dentist bill. I wanted to pay my son’s school £20 on Thursday morning because he was going on a school trip, and I turned the house upside down looking for the chequebook, which I couldn’t find. I couldn’t pay them with a debit card, or cash (I didn’t have £20), or credit card, or bank transfer or any of the other “perfectly fine” ways to make the payment. Which boring tale illustrates the real point, that is, not that…

We already have a perfectly fine way to make non-cash payments.
[From Paying by phone is insecure and unnecessary. – By Farhad Manjoo – Slate Magazine]

…but that we don’t have a perfectly fine way to take non-cash payments. Mobile payments will be a disruptive force because the devices will serve both roles. Richard Johnson of Monitise made this point very well at the Intellect Payments Workstream meeting that I chaired last week. But it isn’t only the cheque that is set for extinction because of mobile. Anthony Jenkins, the chief executive of Barclaycard (Britain’s biggest card issuer), said that

“In 50 or maybe even 10 years’ time, we will still be using cash but I don’t think we’ll have plastic. It is comparable to the move from CDs to MP3 music files,” he said. “If I had said 10 years ago that you couldn’t pay with a cheque at the supermarket, you wouldn’t have believed me. That is now the reality, and we see plastic cards going the same way.”
[From End of the road for flexible friend as Barclaycard goes ‘contactless’ – Telegraph]

Now this seems a little far-fetched on first reading. But perhaps, once mobile payments cross the cusp into the mainstream (at, I would guess, around a 25% penetration in the consumer market), the move away from plastic could take place in a generation, much as the move into plastic did from the introduction of the magnetic stripe in the early 1970s.

Coins, paper money and plastic cards are going to be the next casualties. Don’t believe me? Then visit Korea. The only people who own a plastic credit card there are the ones who travel abroad; everyone else uses their mobile phone.
[From Peter Cochrane’s Blog: Near-field tech edges closer | CIO Insights | silicon.com]

The combination of mobile and contactless seems to accelerate the transition: individually they are great, but together they are something special. Mobile payments by themselves have been around forever and have made little impact in the physical world (except for special niches like car parking). I still can’t use my mobile to buy a bottle of cold water from a machine in the Tube.

The first case of a mobile phone being able to be used to handle a payment was in 1998 as an experiment in Espoo Finland just outside of Helsinki, where two Coca Cola vending machines were installed with a mechanism to accept payment by SMS text messaging
[From Communities Dominate Brands: End of Cash? First blog in a series examining the pending doom of minted coins and printed banknotes]

Adding contactless transforms the proposition from fiddling about sending text messages to a quick tap. As far as I can tell, from the pilots that we have been involved in, customers are not a barrier. They like it. So why doesn’t my phone have NFC in it right now, and why doesn’t the drinks vending machine on the Tube have a reader?

Why is it taking so long? As with Faster Payments, the problem lies with the marketing teams in the major banks.
[From The innovative world of UK payments]

I disagree. I’m no fan of marketing departments, but the problem with mobile payments is different. Banks have never had to deal with payments in this way before: they can control ATMs and POS terminals, EMV cards and FPS. But they don’t control mobile, and in particular they don’t control the Secure Element (SE), the tamper-resistant hardware that transforms mobile phones from being content devices to transaction devices. There are different ways of dealing with this, but I think it is fair to reflect that the specific tension between banks and mobile operators remains problematic. In some countries they are joining forces, in others they are forging bilateral agreements, in others they are going their own.

while credit card companies might need the carriers to get into mobile payments, they might soon learn that the carriers don’t need them.
[From In mobile payments, credit card companies might be a third wheel | Econsultancy]

Indeed they don’t, but that has no relevance to the Isis initiative that is the subject of that post because

Verizon, T-Mobile and AT&T are entering into an agreement to let customers pay for products with their smartphones… they are not working with Visa, MasterCard, or American Express on this venture. They’re not working alone either, instead partnering with Discover and Barclays on this venture.
[From In mobile payments, credit card companies might be a third wheel | Econsultancy]

Hhmmm. So in this particular case, the carriers are partnering with a credit card company and a bank. So do they have somewhere to go? Well, let’s return to the point. We don’t have a perfectly fine way of taking non-cash payments, but soon we will because of mobile phones. And there are some dynamic go-ahead organisations that have already recognised this.

the local Girl Scout group there has teamed up with Intuit to accept credit cards using the company’s GoPayment app (and accompanying card reader) for iOS and Android
[From Teh Gay Geek: GIRL SCOUTS IN OHIO TAKING MOBILE PAYMENTS FOR COOKIES]

Back in the 1980s, there were people who said that mobile phones would never sell because there were payphones everywhere (eg, McKinsey). The POS terminal of 2011 is the payphone of 1981.

US savings

28th March 2011by Consult HyperionLeave a comment

What would a rational US policy on the circulating medium of exchange look like? What notes and coins should be in circulation? I think it’s time to start thinking about narrowing the range in order to reduce costs (and increase convenience).

One obvious way to reduce costs would be to follow countries including Australia and Canada and in replacing paper banknotes with plastic (polymer) banknotes. In a paper on this called “Production Costs, Seigniorage and Counterfeiting: Central Banks’ Incentives for Improving their Banknote Technology” from October last year, Forum friend Leo van Hove, together with co-authors Bouhdaoui and Bounie, calculates that the adoption of such notes would entail a drop in seigniorage revenue of roughly 0.1% (because of higher initial production costs) but would halve the annual replacement costs for banknotes, resulting in net savings of $374m per annum.

Using data from 1998, they find that the biggest cost saving would come from moving to a plastic $20, whereas the replacement of the $100 bill only becomes profitable after accounting for counterfeiting because without the reduction in counterfeiting the decrease in seigniorage revenue exceeds the savings in replacement costs. It’s easy to see why: $100 bills are not used to support commerce, so they don’t circulate in the US (I’m sure the majority are outside the US and will never be repatriated) and therefore don’t get worn and returned for replacement, whereas $20s are still used in retail.

In fact, I’ve noticed that more and more places in the US will no longer accept bills greater than $20 anyway, so if the US government could be persuaded to give up the seigniorage income from the $100 (in return for much reduced tax evasion and such like) then it would surely be sensible to move the $5, $10 and $20 to plastic and abolish the $50 and $100.

The $1 is another case entirely. The US is crazy to continue producing $1 bills as well as pennies that cost nearly two cents to make. I say scrap both. Give up on the penny and make the $1 coin work (which it would do if there were a deadline for withdrawing the bills). Leo and the chaps note that the “golden dollar” coin costs six times more to produce than the $1 bill (but lasts 14 times longer) ). If the government were to completely replace the $1 bill with the coin then it would save $116m per annum. This is interestingly slightly less than the estimate of $119m per annum it would save by going to plastic $1 bills.

The coin still makes more sense. Personally, I would much prefer to use a contactless card or mobile phone in the luggage cart machine at the airport, at the parking meter and in the Coke machine then mess about with coins or bills, but at least coins work in vending machines whereas bills drive you crazy being rejected again and again. I did notice, though, that the airport cart people have found an imaginative alternative solution: now they charge $4 instead of coins they take cards…

Maybe we need a new, technology-neutral Durbin-like amendement to reduce the cost of payments in the US, but this time one that doesn’t discriminate in favour of cash at the expense of more efficient alternatives and imposes cost-reduction targets on the currency. Incidentally, just to show how up-to-date I am with my finger on the pulse of money, after typing in the above, I settled down and found myself reading this…

In American, the questions are still more pressing, involving the return to specie payments, the future regulation of paper currency, its partial replacement by coin, and the exact size and character of the American dollar.

What hip and trendy blog did I find this on? Actually, it’s from “Money and the Mechanism of Exchange” by William Stanley Jevons, published in 1875. Money’s a conservative topic.

Party like it’s 2019

24th March 2011by Consult Hyperion1 Comment

After sitting in on a few sessions at the International Payments Summit 2011 — and in particular the excellent Chatham House session chaired by Forum friend Ruth Wandhofer of Citi — I have to say that in all honesty my professional opinion is that it’s a mess. The ECB predicted that SEPA would erode payment margins in Europe by 5-10% (eventually) but that banks and customers would benefit from lower costs in the long run. Yet the cost burden is crushing. According Equens, there are 200 different formats for SEPA Credit Transfer (SCT) and SEPA Direct Debit (SDD) messages. They further estimate that since both the XML message formats and the EPC rulebooks are updated every year, it means 20-30,000 man-days per annum just to maintain the software. And that’s for just one processor. What’s more, SEPA is reducing competition (and therefore increasing costs) in local markets long before the projected cost savings arrive.

One way to do something to bring on these cost savings might be to enforce and end date. When I had the honour of chairing ECB board member Gertrude Tumpel-Gugerell in Brussels last November, she said that an end-date for SEPA would be her first New Year’s resolution for 2011. Well all I can say after IPS 2011, is good luck Gertrude. If there is going to be an agreed end-date this year, I’d lay a pound to a penny that it will be 2019. Frankly, who knows what will have happened to the payments business by then?

Gertrude and others have said that one of the goals of SEPA was to encourage innovation to the payment sector, but has it? Tom Noyes excellent analysis of the current environment ends with three key constraints on innovation.

Innovators are dependent on local national relationships to launch a product;
SEPA creates harmonization, but country specific laws and regulatory guidance are unique;
ECB initiatives (ex. See ELMI) create opportunities for non-bank participation in payments, but SEPA has removed all margin from the business.
[From Payments Innovation in Europe « FinVentures]

I’m not so sure about that last point. SEPA has removed all of the margin if you are bank, but if you are not a bank and are not dependent on their high-cost, highly-regulated infrastructure. All of these issues mean that I can’t help but let an evil thought wander in to myconsciousness, a thought-crime of the most serious degree. What is SEPA doesn’t happen? What if it ends up defining the standard for pan-European payment infrastructure that is vanishing? Worse still, what if there are sinister forces at work to torpedo the project?

The EC will “effectively derail the entire Sepa project” if upcoming regulatory intervention on migration end dates does not include deadlines for phasing out national schemes, says the European Payments Council.
[From Finextra: EC migration plans would ‘derail the entire Sepa project’ – EPC]

I don’t want to bore foreign readers with the ins and outs of the relationship between the Commission and the EPC, but I will say that it is not good. If the Commission regulatory “intervention” were to be to mandate the EPC rulebooks with a fixed deadline, then banks (I’m pretty sure, having spoken to quite a few bankers about this) would grin and bear it. In some countries (eg, Germany) it might be an unpopular decision, but it would get done. Instead, the Commission seem to want to tinker with what the EPC has been going but without an end date? Why? (Answer: because they are politicians responding to national interests.)

Personally, I think the Commission are derailing the train taking us to lower costs in other ways as well, such as by forcing retailers to accept euro coins and high-value euro banknotes, thus promoting the least efficient and most expensive payment mechanism instead of electronic alternatives that would be better for society.

Cached

23rd March 2011by Consult HyperionLeave a comment

Once again, an outraged article in a British tabloid — this time the Daily Mail — about the end of cheque clearing in 2018. Predictably, it is the desperate plight of the elderly that forms the centrepiece of Lauren Thompson’s article “Clueless banks pressing on with purge on cheques”, featuring a case study on a 76-year old woman who sends her gardener to the Post Office every week to collect her £315 in benefits. She says “cheques work perfectly well for me”.

From April next year, Giro cheques will be scrapped. Pensioners and benefit claimants will be forced to go to their nearest PayPoint outlet – found at shops like Co-op, spar and Sainsbury’s Local – instead of the Post Office.
[From Banks and the Government are pressing on with purge on cheques | Mail Online]

It is not explained why sending her gardener to the corner shop to pick up her benefits from a PayPoint terminal fills her with such dread, but her comment is telling: cheques work well for her because I’m paying for them. I couldn’t care less if I never see a cheque again: the only cheques we’ve written in the last month have been to schools (I simply don’t understand why they can’t take PayPal or payment via FPS) and to the local council, which presumably regards cheques as the most modern of payment instruments. But cheques waste time and money, and it’s right to have a national plan to get rid of them, no matter what the Daily Mail thinks about the Payments Council.

I have to say that I sympathise with the Payments Council. I read somewhere that half of British consumers are unaware of the 2018 target date to end cheque clearing. But then half of them of unaware of anything, so I’m not sure that there’s much the Payments Council could do to change this. We live, as I’m often reminded, in a country where 50% of the population don’t know what 50% means.

The Payments Council seems to have become a particular target for middle England’s hatred. A letter in the very same edition of the newspaper notes that “obviously banks prefer cheaper systems of cards and electronic transfer” (as do I) and asks what about (once again) elderly or housebound people who depend on cheques by post. This is an interesting line of debate. In Finland, no-one has used a cheque since 1993. Nobody in Sweden has a cheque book. You would need a Powerpoint presentation to explain what a cheque is to anyone under 30 in the Netherlands. Yet elderly and/or housebound people seem to survive in Rotterdam and Espoo. Unless the Daily Mail has a specific reason to suspect that elderly people in Amersham are somehow stupider, or less flexible, or less able to learn than elderly people in Amsterdam, I don’t understand the problem.

Of course, the Daily Mail could always step in to ameliorate these desperate circumstances. Cheques aren’t being outlawed in 2018, but cheque clearing is going to stop. If Associated Newspapers wants to apply for a Payment Institution (PI) licence and operate its own cheque system, then good luck to them. I truly hope that they can do this and make a profitable business out of it, because I am genuinely in favour of choice. The merit of this plan is evident: people who want to keep on using cheques can pay for them. I should say, by the way, that this won’t predominantly be pensioners and their domestic staff, but small businesses.

Obviously mobile payments will be huge. But from my perspective, it is easy to get caught up in what the 5-10% first movers are doing and forget that less than 30% of all small businesses accept any form of electronic payment.
[From PYMNTS Innovator: Checks are Checking Out – Will that be Cash, Credit or Mobile? – pymnts.com]

This is one of the reasons why I spent my time at PayPal X looking at the SME solutions rather than some of the “sexier” new technology thangs like set-top box payments. I’m not negative about this at all – a great many small businesses are moving to electronic payments (I bought my wife some jewellery from a stall at a charity fair last weekend and the lady happily accepted my credit card using her rented GPRS terminal – she told me it cost her £27 per month plus a per-transaction fee and that she was delighted with it) and I don’t doubt the trend will accelerate as mobile payments grow and their convenience overtakes the conservative inertia around cheque payments.

Even in the cheque’s last redoubt, the United States, its position is being eroded. All new federal benefit recipients will be switched to electronic transfer from May of this year and all existing cheque recipients will be switched to electronic transfer by 2013. These moves will save the government more than $100m per annum. And there are plenty of other problems with cheques aside from the cost (which, to be fair, has been substantially reduced because of Check21). Here’s noted computer scientist Don Knuth, reflecting on some bank fraud problems that arise from the fact that account details are printed on the face of cheques.

One consequence of this debacle is, alas, that I can no longer write checks to reward the people who discover errors in my books. The system that I’ve been using has worked well for almost forty years; but recently I have had to close three checking accounts, and the criminal attacks on those accounts have caused significant grief to my bankers… Instead of writing personal checks, I’ll write personal certificates of deposit to each awardee’s account at the Bank of San Serriffe, which is an offshore institution that has branches in Blefuscu and Elbonia on the planet Pincus.
[From Knuth: Recent News]

The switch is underway from checks as well as cheques. The primary beneficiary of the switch will, I think, more likely be the prepaid card industry rather than the Bank of San Serriffe, because the economics of banking mean that providing what used to be known as “basic bank accounts” to most of these welfare recipients makes no sense, and I expect the increase in volume to bring more players, and more competition, and therefore better products to the sector. Now, let me be clear in saying that I am not shilling for the prepaid boys here. There are plenty of things wrong with the prepaid proposition (and I’ll be writing more about this shortly). But as prepaid evolves to the mobile, TV and other platforms, it provides the natural route to cheque eradication, and even Joan Bakewell will get used to it.

NFC in the real world

22nd March 2011by Consult HyperionLeave a comment

Nick Holland from Yankee Group made a good point in their recent webinar on “NFC Not Just for Cards“. I’m probably only saying it’s a good point because it’s a point that I make too, but nevertheless the addition of an NFC interface to a mobile does change the relationship between the real and virtual worlds.

Put the two things together, in the form of near-field communication (NFC) handsets, and you have something special… Over the coming decade, the mobile phone will shift from being a network end-point to being a pivot between local and global environments, an indispensable and personal security token that bridges physical and virtual commerce.
[From Digital Money: Ten more years of technology]

Nick talked about this “hyperlinking” to the physical world and made the sensible point that while dull persons such as myself are obsessed with payments, the use of NFC will be far wider. This is perfectly correct, and I happened to see an excellent illustration of this general point in NFC World this very morn.

Some 35,000 households in Haiti are receiving ‘clean water’ buckets — which consist of a chlorine solution and an RFID-tagged five-gallon bucket to treat and store water — from the charity Deep Springs International (DSI). On each bucket is an RFID tag which is read during regular visits by community-based health workers who carry NFC-equipped Nokia 6212 phones. Just holding the phone up to the bucket reads the tag and records the visit, then they measure the amount of chlorine in the water and key it in to the handset
[From NFC phones help provide clean water to Haiti earthquake victims • NFC World]

In fact we have consistently advised clients that payments will be a niche. Anyway, Nick is correct, and on the Digital Identity Blog I’ve repeatedly made the point that the use of NFC to support digital identity applications will, in the long run, be far more important than digital money applications. A big step forward in assembling this infrastructure went almost unnoticed last year when the NFC specifications were extended to include the digital signing of data.

The Signature RTD candidate technical specification helps users verify the authenticity and integrity of data within NDEF messages by specifying the format to be used when signing single or multiple NDEF records. It defines the required and optional signature RTD fields, and also provides a list of suitable signature algorithms and certificate types that can be used to create the signature
[From NFC Forum : NFC Forum Announces Specifications to Support Peer-to-Peer Device Communication and Verify Data Authenticity ]

This is important, because if you want to go round touching real world things and have them connect to virtual world things, you need to be sure that they are what you think they are and they are part of the right infrastructure. When I tap on the poster in the restaurant window, I want to be sure that it is a legitimate hyperlink that will take me to a menu and not to a porn site. With this infrastructure in place, all sorts of new businesses become possible (and desirable). It means that someone if going to have organise how exactly the key, certificates and signatures are going to work and interoperate and that someone probably won’t be the mobile operators but a new entrant.

These “pivot” functions, that link the local and remote environment will, I firmly predict, lead to some incredible new applications. Fortunately, some of them will involve payments, which will be really good news for some of our clients.

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]

It all comes back to liability

14th March 2011by Consult HyperionLeave a comment

I posted about the silo-style identity and authentication schemes we have in place at the moment and complained that we are making no progress on federation. Steve Wilson posted a thoughtful reply and picked me up on a few points, such as my “idea” (that’s a bit strong – more of a notion, really) of developing an equivalent of creative commons licences, a sort of open source framework. He says

CC licenses wouldn’t ever be enough. Absent new laws to make this kind of grand identity federation happen, we will still need new contracts — brand new contracts of an unusual form — struck between all the parties.
[From comment on Digital Identity: The sorry state of id and authentication]

But isn’t that what CC licences solve?

It’s complicated by the fact that banks & telcos don’t naturally see themselves as “identity providers”, not in the open anyway
[From comment on Digital Identity: The sorry state of id and authentication]

Well, I’m doing what I can to change that (see, for example, the Visa/CSFI Research Fellowship), but on the main point I happened to be reading the notes from the EURIM Identity Governance Subgroup meeting on 23 February 2011, talking about business cases for population scale identity management systems. The notes say that

It is alleged that the only body with the remit, power and capability needed for assuring and recording a root identity through a secure and reliable registration process is Government.

The notes then go on to talk about case studies such as the Nordic bank-issued eIDs though. These arguments are to some extent circular, of course, because the e-government applications in the Nordics are using bank-issued eIDs, but the only reason that the banks can issue these eIDs is because they are using government ID as the basis for KYC. In the discussion about this at a recent roundtable in that Visa/CSFI “Identity and Financial Services” series, someone made a comment in passing (and I’m embarrassed to say that I can’t remember who said this, because I noted the comment but forgot the commenter) that all of this takes places in a model absent liability. That is, as far as I understand what was said, the government accepts no liability from the banks, and vice versa. So if the bank opens an account for me Sven Birch, using a government “Sven Birch” identity, but it subsequently transpires that I am actually Theogenes de Montford, then the bank cannot claim against the government. Similarly, if I used my bank eID “Sven Birch” to access government services, but it subsequently transpires that I am actually Theogenes, then the government has no claim against the bank. (If this isn’t true, by the way, I would appreciate clarification from a knowledgeable correspondent.)

So what is the situation? Must we have a liability model, or can we all agree to get along without one. Or do you have to a have a more consensual society, or perhaps one with fewer lawyers per head of population?

Hip to be Square

12th March 2011by Consult Hyperion1 Comment

Many years ago, when I was a mere slip of a consultant, I was sent by a client to check out a company called WorldPay, then run by Forum friend Nick Ogden. I reported back to the retail bank I was engaged by that I couldn’t see where WorldPay was going, since it didn’t provide any service that the bank couldn’t provide themselves given a small amount of development effort. Therefore I assumed that the bank, like all other banks, would soon be providing a comprehensive range of services for new internet businesses and that WorldPay’s niche would vanish.

Royal Bank of Scotland Group Plc, the U.K.’s biggest government-owned bank, agreed to sell its credit- card payment processing unit to Advent International Corp. and Bain Capital LLC for 1.7 billion pounds ($2.7 billion).
[From RBS Sells WorldPay to Advent, Bain for $2.7 Billion – Bloomberg]

Please! Don’t listen to me about anything to do with business! I didn’t realise that there is no such thing as a quick and dirty development in a bank, and that starting a new line of business doesn’t happen overnight. There’s a big, big gap between people like me saying that all the bank needs is a simple internet gateway and a merchant acquisition process and these systems and processes actually getting going. Things just don’t work like that, for all of the well-known reasons (focus on core business etc). I was thinking about this when I got into a discussion with someone a few days ago. They said that Square does nothing that existing stakeholders in the card business couldn’t do themselves, so it has no long-term future, the argument being that Barclays or Streamline could just offer a similar service. And Square is reducing its charges, meaning less margin, so they won’t be able to beat the big boys on cost either.

Square’s rates will fall to a flat fee of 2.75 percent per transaction instead of charging 2.75 percent plus an additional 15 cents. (The rate for when a credit card number is keyed in, rather than swiped, will remain the same at 3.5 percent plus 15 cents.)
[From Square Sacrifices Revenues to Ramp Mobile Payment Volumes | Tricia Duryee | eMoney | AllThingsD]

All true. But the reality is that just because other merchant acquirers could do this does not mean that they can do this, and if Square can provide just enough added-value with their app to get traction in the small business sector (they are already processing a million dollars a day), then when new payment technologies come along (eg, NFC phones that can accept payments from contactless cards) the merchants will just expect Square to handle them for them. We have long been advising clients that the key disruptive role of mobile phones in the payments world is the ability to take payments, not to make them.

Incidentally, I can’t resisting commenting on the Square-based debate that sprung up over the last few days. As I’m sure you all know, Verifone wrote an open letter pointing out that Square is not fully PCI compliant, something that has been known since the product was first announced.

iPhone cannot be made PCI compliant without first encrypting the card BEFORE it gets into the iPhone (see the Verifone solution)
[From Square Up update « FinVentures]

Not that interesting, to be honest, but it did stir things up and Square had to respond, which they did by pointing out that the problem is with a payment system built on trivially-copyable magnetic stripes and the like.

In his response, Dorsey said any technology, including “an encrypted card reader, phone camera or plain old pen and paper,” can be used to steal information. “If you provide your credit card to someone who intends to steal from you, they already have everything they need: the information on the front of your card,”
[From Square Responds to VeriFone s Security Claims – American Banker Article]

Will master criminals intent on skimming card numbers sign up with Square and then install a dodgy app? Probably not. There are plenty of better options out there, including the existing magnetic stripe readers that the criminals already use.

Exposing Square’s security vulnerabilities in this manner is an act of outright hostility on VeriFone’s part, and a sign that it’s unnerved by Square’s growth.
[From VeriFone Attacks Rival Square With Ethically-Questionable Security Exploit: Apple News, Tips and Reviews «]

Not that it’s any of my business, but this is why the letter looks like a mistake. If I were Verifone, I would have spent my time making a better iPhone card reader, or something that plugs in to Android phones or EMV chip/contactless readers or whatever, or partnering with people to deliver great merchant service, or something else to compete.

Still going strong after 14 years

11th March 2011by Consult HyperionLeave a comment

The 14th annual Consult Hyperion Digital Money Forum was terrific. Here’s some of the feedback we’ve already had:

“Excellent! Thank you again”
“A most enjoyable event with a variety of speakers”
“It was very stimulating”
“A very informative conference which didn’t disappoint.”
“Very good – as always, so much new stuff”
“a terrific #dmf14 session on private vs public money”
“I saw the future, the past and, surprisingly, the freedom of cash.”
“Very good – as always, so much new stuff!”

First of all, and I can’t say this often enough, a very big thank you to the event sponsors who made it all possible: Visa Europe and Monitise. For an event like the Forum it’s really important to have sponsors who share our goals, and both of them were great, giving us the freedom to choose an eclectic mix of speakers and panelist who really helped the delegates (and us) to think in some new ways and to spark off new ideas about where to go next in the world of e-payments. This makes for a special event, unlike the commercial conferences that we attend throughout the year. The economist Diane Coyle, who was kind enough to chair the keynote session on day two, put it very nicely

As ever the Digital Money Forum proved itself a must for anyone interested in the intersection of technology and money
[From The Enlightened Economist :: Good money, digital or analogue]

And thanks also to our newest supporters, Olswang, who kindly sponsored to pub quiz (which was great fun) and the drinks that went with it.

I won’t go over everything that was discussed — the presentations are online if you want to download them — but I will highlight a couple of points that emerged over the two days. First of all, both of the opening sessions, which mixed history and future, worked very well and did, I think, help people to think more imaginatively about the discussions later in the day. The expert panels were popular as always, although I really should keep them to only four people per panel. I’ve had some interesting feedback about the panel on alternative currencies, which I think gave many organisations some unexpected directions to explore.

Mobile was, naturally, a key topic and pervaded many of the discussions. We may have to make it a bigger fraction of the agenda next year if we can find some new angles to approach it from. A lot of the delegates remarked on how juxtaposing lessons being learned in both developed and developing markets worked well, so that’s something to think about.

We’ve already started thinking about 15th Digital Money Forum and what we’re going to do to change things again. I can promise all of you that the event will keep moving forward. Next year will see a new venue (and, yes, there will be free wifi for all), some new ideas for interaction and some changes in the programme structure. One thing that won’t change is the art and design competition: given the outstanding presentations at the end of this years’ Forum, we’ll definitely do that again! If you weren’t there, I urge you to take a look at the competition winners and appreciate the imagination and invention that went into them.

If I had to highlight one presentation, it was Catherine Eagleton’s keynote. Catherine is the curator of Modern Money at the British Museum and co-author of the excellent Money-A History. She asked the delegates to send her examples of anything that should be preserved, particularly the intermediate forms of new payment systems that are forgotten in the long run. I hope some of them will take her up on that. But she also mentioned in passing how difficult it is to think of ways to preserve World of Warcraft gold pieces or Facebook credits for posterity, and I keep thinking about it now. It came up last year when Consult Hyperion were asked to provide a piece on mobile money for the Science Museum. We were enthusiastic, but soon realised that a phone in a glass case (with a dead battery) is not much of an exhibition, and I’m afraid the curators concurred. So if anyone has any ideas on that one, please get in touch (although it does give me an idea for next year’s competition!).

Oh, and I should finish by saying to everyone who mentioned it (and there were quite a few), yes, the hotel coffee was slop that I wouldn’t have fed to pigs and I swear with my hand on my heart that if we ever serve stuff like that to you again I will personally take all delegates to the nearest Caffe Nero and buy every single one of them a drink there myself.

The sorry state of id and authentication

9th March 2011by Consult Hyperion1 Comment

I had a problem with my PayPal account: I used it in China, and it got blocked as the result of some kind of fraud screening.

I ended up having to promise the guys at Bike Beijing that I will sort this out when I get back to the UK and then send them their money.
[From Digital Money: Holding court]

They still haven’t got their money. In order to unblock the account, you had to log in to your account and then have a code sent via your home telephone number. I clicked, the phone rang, I punched in the number and hung up. Nothing. I clicked again, the phone rang, I punched in the number and waited. Nothing. I clicked again, the phone rang, I punched in the number. After a while, I got an e-mail telling me that the authentication process had failed and so PayPal would send a letter containing some kind of code to my home address and that I could then use this code to unblock my account. It mentioned that the letter might takes six weeks to arrive.

So the nice guys at Bike Beijing still don’t have their money and I’m still embarrassed.

Now, all the time that this nonsense about codes and letters was going on, I had on my desk a Barclays’ PINSentry (which I can’t even use to log on to Barclaycard, let alone PayPal) and a O2 mobile phone (I’ve been with O2 for two decades and have a billing relationship with them – their system knew that I was in China) and a keyring OTP generator that we used for our corporate VPN. Any one of these could provide a better solution then messing about typing in code numbers, but they all sit in their own silos and don’t provide the kind of general-purpose services that they should.

What should have happened, of course, is that I should have been able to log in to PayPal using OpenID and then logged in to a 2FA OpenID using my (say) PINSentry. So now PayPal knows that I have been 2FA logged in from an “acceptable” source (ie, Barclays Bank) and we could move on. So why doesn’t this happen? Is it because OpenID has failed?

But if OpenID is a failure, it’s one of the web’s most successful failures. OpenID is available on more than 50,000 websites. There are over a billion OpenID enabled URLs on the web thanks to providers like Google, Yahoo and AOL. Yet, for most people, trying to log in to every website using OpenID remains a difficult task, which means that while thousands of websites support it, hardly anyone uses OpenID.
[From OpenID: The Web’s Most Successful Failure | Webmonkey | Wired.com]

It can’t be that. OpenID has plenty of support, and even the US government got behind it.

Who would have predicted say, 5 years ago, that you would some day be able to use commercial identities on government websites? Evidently, this raises questions about privacy and security but if these initiatives can garner enough public support, government validation of open identity frameworks could be a boon for the ecosystem of the open, distributed web. Plus, it can make dealing with the government a lot easier for you, too.
[From US Government To Embrace OpenID, Courtesy Of Google, Yahoo, PayPal Et Al.]

It’s not about the technology. I make no judgement as to whether OpenID is the best technology or not (although it does actually exist, which is a good start), but the truth is that it simply doesn’t matter whether it is or it isn’t.

The unresolved business and legal challenges implicit in federated identity are to blame for the under-delivery of OpenID
[From OpenID, Successful Failures And New Federated Identity Options | Forrester Blogs]

Indeed they are. So the problem isn’t really anything to do with OpenID, or any other framework that might come along in cyberspace, but the legal framework that it has to sit inside. This is where we need the breakthrough. We need potential identity providers (eg, Barclays, O2) to be able to set up OpenID responders for their customers inside a well-known and well-understood legal framework. Now, you can do this contractually (as IdenTrust has done), but to scale to the open web, we need something more than that, perhaps an equivalent of the “creative commons” licences that are used for content but for credentials.

Even then, would someone like PayPal rely on them? Or would it only rely on identities from regulated financial institutions in the EU? Or only such institutions that met some minimum authentication standard? We’re a long way from fixing my Chinese problem, despite having all of the technology needed to do so.