News from the bunker

by Leave a Comment

The government is battening down the hatches and repelling all boarders, even if they have e-tickets. And not before time!

Foreign intelligence agencies are carrying out sustained cyberattacks on the UK Treasury, targeting it with malicious emails and programs designed to steal information, the Chancellor, George Osborne, has revealed. He said that government systems are the target of up to 20,000 malicious emails every month

[From Osborne: Treasury under sustained cyberattack | Technology | guardian.co.uk]

And that’s not counting the ones from taxpayers, I imagine. Setting aside how ludicrous and meaningless this figure is, there is nonetheless a serious point. If Son-of-Stuxnet crashes the Treasury, that might well be a net benefit to the economy, but if it crashes the electricity distribution network, even I won’t be laughing. We need effective cyberdefences. So what should the authorities do to bolster these defences? I would have thought that have some kind of working identity infrastructure might be a first step, and in that respect things haven’t been going to well in the UK.

The Home Office slipped out the final report of the Independent Scheme Advisory Panel (ISAP) this week, more than a year after it was written. The ostensibly independent report, which reveals how the ID system had been compromised by poor design and management, was submitted to the Home Office in December 2009.

[From Henry Porter - Home Office suppressed embarrassing ID cards report]

The report says that there were no specifications for usage or verification (which we knew – this was one of my constant complaints at the time) and, revealingly, that (in section 3.3) that “it is likely that European travel” will emerge as the key consumer benefit. This, I think, is an interesting comment. As I have pointed, what the Identity & Passport Service (IPS) delivered was, well, a passport. It had no other functionality and, given the heritage, was never going to have. Hence my idea of renaming it “Passport Plus” and selling it to frequent travellers (eg, me) as a convenience, and idea that really should have been taken more seriously by the coalition administration.

As an aside, the report also says (in section 5.5) that the “significant” number of change requests after the contracts had been awarded would likely increase risk, cost and timescale. Again, while this is a predictable comment, it is a reflection on the outdated consultation, specification and procurement processes used. Instead of a flagship government project heralding a new economy, we ended up with the usual fare: incomplete specifications, huge management consultant bills, massive and inflexible supply contracts.

The report repeated the same warnings ISAP had given the Home Office every year since the system blueprint was published in December 2006 by Liam Byrne and Joan Ryan, then Home Office Ministers, and James Hall, then head of the Identity and Passport Service (IPS).

[From Home Office suppressed embarrassing ID cards report - 1/7/2011 - Computer Weekly]

How did it all go do wrong? Liam Byrne was supposed something about IT as he used to work for Accenture, as did the James Hall (Joan Ryan was a sociology teacher who later became famous for claiming more than £170k/annum in expenses). All in all, it was a pretty disastrous period for those of us who think that identity infrastructure is crucial to the future of UK plc, let alone the UK government. This is not to say that, despite all of the evidence (including today’s fascinating FT piece on the UK government’s equally disastrous NHS infrastructure project), that the UK is uniquely hopeless at developing identity infrastructure for the 21st century.

Thai citizens who applied for their first national identity card or who applied to have their ID card renewed, have been issued with a yellow slip instead of the new microchip-embedded “smart” cards. The reason behind the problem is that the Interior Ministry refused to accept the new “smart” cards which were supplied by the Ministry of Information and Communications Technology, claiming that they did not meet the prescribed specifications stipulated in the ministerial regulation.

[From Bangkok Post : The silly saga of 'smart' cards]

Now, this may seem funny, but I ought to point out in the interests of international balance that there are, right now, in 2011, many people walking around branches of the British government with printed pictures of smart cards hanging around their necks. Yes, that’s right: pictures of smart cards, rather than actual smart cards. I’m afraid our cyberdefences are more a cyber home guard at the moment.

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

What Google thinks about NFC is important

by 2 Comments

A couple of people asked yesterday about the comments from Google concerning “card emulation” in Android phones. The twitterverse had noticed these remarks from Nick Pelly, the Android lead for NFC, concerning the lack of API support for NFC card emulation.

The problem is that the hardware out there today, you know, if you buy an NFC controller, it typically is only going to be able to emulate one of those RF-level technologies. So as an application developer, you don’t know which — when it’s getting deployed to a phone, which one is on the phone. So I guess until we see the industry standardize around maybe one RF-level technology or until we see NFC controllers able to support multiple of those

[From� Google raises concerns over the viability of NFC card emulation mode for mobile payments • NFC World]

At first I just thought… wow, that’s smart. If Android phones won’t allow ISO 14443 card emulation (which is part of the NFC standard) then that means that Visa and MasterCard won’t be able to use them for payments, thus locking them out of the POS terminals that Google is developing for retailers. As I thought about it, however, and actually read what Nick had said, I realised that I couldn’t understand his comments, since phones are perfectly capable of dispatching to different applications depending on which card they read, so I thought I’d go and ask a couple of the world’s leading experts on implementing secure NFC applications in mobile phones. Fortunately Stuart Fiske and Neil Livingston both work for Consult Hyperion, so it was easy to find them. They told me…

We know that NXP and Inside Secure NFC controller devices support A, B, B’ and Mifare, all on the same chipset. GP provides mechanisms to manage protocol conflicts, etc., when multiple applets relying on incompatible protocols are trying to be active on the interface at the same time.

I thought this must be true, since I had in my office a Nokia handset with NFC that supports both contactless EMV transactions and contactless Oyster (ie, MiFare) transactions and it worked perfectly. I read a little further, and once again became confused. Due to my lack of experience, I was unable to determine what this means:

Typically, the hardware is set up to do card emulation through the secure element. Right now, we don’t have any APIs to talk to the secure element. And we think that we probably won’t be getting APIs to do that anytime in the near future in the SDK.

There are a bunch of different reasons. Again, the secure element is a very limited resource. It can’t hold a large amount of data in there. And if we open it up to any third-party application, there’s going to be a huge resource contention over the secure element.

Additionally, to talk to the secure elements, even from applications on the phone, you need to authenticate yourself properly.

And if you improperly authenticate yourself a certain number of times, there are secure elements out there that will physically destroy themselves and can never be recovered. So that’s something that we really think would be a bad experience for users

[From� Google raises concerns over the viability of NFC card emulation mode for mobile payments • NFC World]

I have absolutely no idea what he’s talking about. I have never heard of a handset secure element (SE) that will physically destroy itself if authentication fails. I’ve checked the SmartMX data sheet this morning and I can’t see any such logic.

Screen shot 2011-05-12 at 11.03.45.png

If I put the wrong PIN into an EMV application in the secure element three times, it will lock and then require an over-the-air PIN unlock from the application issuer, but that’s a good thing. It’s certainly true that there’s a problem with secure applications controlling the screen and keyboard during authentication, but that’s because the Nexus doesn’t have any form of trusted execution mode and this is a well-known and well-understood (at least it’s well-known and well-understood by Consult Hyperion) constraint that feeds into the kind of risk analysis that we do for organisations who are thinking about developing transactional applications. The authentication itself is done within the SE, naturally, but you may have a virus that’s capturing the PIN, for example.

Meanwhile, I was thinking about the SE more. If I buy a Nexus S, how would an application provider request a Security Domain (SD) from Google? How would it be provisioned? Is Google building a Trusted Service Manager (TSM) to sell such a service? I haven’t got a clue. The guys told me (these are edited highlights, by the way)…

In J2ME, it’s typically the SE issuer (ie, Google, in this instance) that decides who can access the SE from apps in the phone, and sets up the access conditions on the SE to manage this (the ACF file). Essentially, what we need the Android stack to do is deliver what J2ME (and it’s JSRs) have been doing for several years now. That is, include APIs that provide the app with a mechanism to access an applet in the SE, and for Android to interact with the SE to manage access condition verification. You can’t block the SE if you can’t access it!…

…These comments from Google make it sound like Google won’t be doing anything with card emulation any time soon. If that’s the case, then what’s with all these stories about Google trialling contactless card payments in SF with MasterCard and Citibank, uing Verifone and Ingenico POS terminals? These POS terminals implement 14443 to read contactless cards, and I doubt that Google are going to develop custom terminals that implement P2P ISO 18000 instead. But who knows – it would be cool if they did…

…Perhaps the Android stack doesn’t need to implement card emulation mode if the underlying hardware implements it, i.e. if the NFC controller and SE together support 14443 and card emulation mode, then they can talk to the reader via the antenna independent of the Android stack. The stack needs to provide an access API to allow phone apps to access applets over the contact interface (if there is one, e.g. SIM), or the wired interface for embedded, or via the SD interface….

…So perhaps there is no need for a card emulation stack in Android after all? But we still need ot be able to switch the PN544 into card emulation mode and an SE access API supporting a decent access control mechanism…

That’s the actual problem, then. Developers can get to the SE interface but they can’t do anything with it (eg, load a payment card into it).

As of the 2.3.3 release of Gingerbread the Secure Element functionality has been enabled (but the API Hidden). You can confirm that there is a Secure Element (SmartMX) in the Nexus S just by looking at the debug log using adb logcat and switching on NFC via settings… That said I’m assuming that the keys etc are controlled by Google so actually doing anything with the embedded SE will be difficult/impossible at the moment.

[From� Secure Element - SmartMX - seek-for-android | Google Groups]

What has happened is that Google used an NXP NFC stack when building the Android operating system image for the Nexus S, but switched off the card emulation using compiler switches. (There’s nothing to stop you, by the way, from recompiling the stack with those switches set to allow card emulation.) My interim conclusion is, then, that I have no idea what is going on. I don’t understand what Google mean and I don’t see how they can stop anyone from accessing secure elements. Sure, they can stop you for doing anything with the embedded SE (theirs) by not giving out any keys, but if there’s a UICC SE (from the operator) you can access that and if there’s an external SE (eg, a DeviceFidelity SD card) you can access that. If there’s no Google Android API elements for any of these, someone else can simply add their own.

After all, Google ordered the Nexus S with embedded secure chips, the PN65 from NXP Semiconductors, which can store applications. The NFC controllers in the phones also support applications for card emulation on SIM cards.

[From� Card Emulation Expected Soon Despite Doubts from Google Engineers | NFC Times – Near Field Communication and all contactless technology.]

Indeed. So why the fuss? What does it matter whether Google want to provide card emulation APIs or not? The things is that Google’s opinions about NFC have taken on more and more significance recently as it has become clear that whatever mobile operators and banks may think about NFC, Google thinks that it is important and will drive it into the marketplace.

Google has obviously made a decision that NFC is an opening into something more interesting and lucrative than transforming a phone into a payment card– advertising and marketing opportunities at the point of sale – the physical point of sale. And, it has done a deal with VeriFone that takes the economic sting away from the merchants who need to buy into their vision to make it work – and who have by and large turned their noses up at NFC up to this point. Layer on top of that their Google Checkout asset and their newly launched One-Pass wallet application and you have the makings of an interesting new payments player.

[From� Google Takes on NFC, Will They Crack the Code? at The Catalyst Code]

Karen is, as usual, spot on with this analysis. But I’m not so sure about this…

What’s amazing is that Google was the first to connect all of these dots

[From� Google Takes on NFC, Will They Crack the Code? at The Catalyst Code]

This doesn’t seem amazing to me, because I’ve been involved in numerous attempts to develop mobile proximity payments for banks and operators. A month before the Google announcement, I wrote on Quora that “I’m sure [loyalty and rewards] will be Google’s strategy too. Payments are not an interesting enough application to persuade people to go out an get an NFC phone.” Years ago, I made a presentation (I think at NFC World but I can’t find it!) in which I said that no consumers will go into retail outlets and buy an NFC phone because of payments. They will buy the NFC phone so that they can read tags, swap Facebook profiles or (now, it seems) play proximity Angry Birds. But once they have that handset, then we need to make it easy and attractive for them to use it for payments.

Incidentally, Dean Bubley, who is in my opinion one of the very best analysts out there, called these non-payment applications “valueless” in a twitter exchange. He’s referring to things like “0-click” checkins and similar.

Starting tomorrow, just tap your NFC-enabled phone (most newer Android devices have it) against the poster, it’ll check you in with foursquare

[From� Experimenting with NFC check-ins for Google I/O | Foursquare Blog]

I’m convinced that valueless is the wrong word. If Google (or Apple) or whoever track where you are via mobile location and then send you special offers, it’s creepy. But if you reach out tap when you enter the shop, or restaurant, or hotel, or office, that’s what advertising folk label “a call to action” that gives them permission to send you things, to steer you, to deliver added value. That’s what retailers will pay for—they’ll get the payments part for free—and that’s why the ecosystem will deliver real value..

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

I see your 14443 and raise you 18092

by 1 Comment

A couple of people asked yesterday about the comments from Google concerning “card emulation” in Android phones. The twitterverse had noticed these remarks from Nick Pelly, the Android lead for NFC, concerning the lack of API support for NFC card emulation.

The problem is that the hardware out there today, you know, if you buy an NFC controller, it typically is only going to be able to emulate one of those RF-level technologies. So as an application developer, you don’t know which — when it’s getting deployed to a phone, which one is on the phone. So I guess until we see the industry standardize around maybe one RF-level technology or until we see NFC controllers able to support multiple of those

[From Google raises concerns over the viability of NFC card emulation mode for mobile payments • NFC World]

At first I just thought… wow, that’s smart. If Android phones won’t allow ISO 14443 card emulation (which is part of the NFC standard) then that means that Visa and MasterCard won’t be able to use them for payments, thus locking them out of the POS terminals that Google is developing for retailers. As I thought about it, however, and actually read what Nick had said, I realised that I couldn’t understand his comments, since phones are perfectly capable of dispatching to different applications depending on which card they read, so I thought I’d go and ask a couple of the world’s leading experts on implementing secure NFC applications in mobile phones. Fortunately Stuart Fiske and Neil Livingston both work for Consult Hyperion, so it was easy to find them. They told me…

We know that NXP and Inside Secure NFC controller devices support A, B, B’ and Mifare, all on the same chipset. GP provides mechanisms to manage protocol conflicts, etc., when multiple applets relying on incompatible protocols are trying to be active on the interface at the same time.

I thought this must be true, since I had in my office a Nokia handset with NFC that supports both contactless EMV transactions and contactless Oyster (ie, MiFare) transactions and it worked perfectly. I read a little further, and once again became confused. Due to my lack of experience, I was unable to determine what this means:

Typically, the hardware is set up to do card emulation through the secure element. Right now, we don’t have any APIs to talk to the secure element. And we think that we probably won’t be getting APIs to do that anytime in the near future in the SDK.

There are a bunch of different reasons. Again, the secure element is a very limited resource. It can’t hold a large amount of data in there. And if we open it up to any third-party application, there’s going to be a huge resource contention over the secure element.

Additionally, to talk to the secure elements, even from applications on the phone, you need to authenticate yourself properly.

And if you improperly authenticate yourself a certain number of times, there are secure elements out there that will physically destroy themselves and can never be recovered. So that’s something that we really think would be a bad experience for users

[From Google raises concerns over the viability of NFC card emulation mode for mobile payments • NFC World]

I have absolutely no idea what he’s talking about. I have never heard of a handset secure element (SE) that will physically destroy itself if authentication fails. I’ve checked the SmartMX data sheet this morning and I can’t see any such logic.

Screen shot 2011-05-12 at 11.03.45.png

If I put the wrong PIN into an EMV application in the secure element three times, it will lock and then require an over-the-air PIN unlock from the application issuer, but that’s a good thing. It’s certainly true that there’s a problem with secure applications controlling the screen and keyboard during authentication, but that’s because the Nexus doesn’t have any form of trusted execution mode and this is a well-known and well-understood (at least it’s well-known and well-understood by Consult Hyperion) constraint that feeds into the kind of risk analysis that we do for organisations who are thinking about developing transactional applications. The authentication itself is done within the SE, naturally, but you may have a virus that’s capturing the PIN, for example.

Meanwhile, I was thinking about the SE more. If I buy a Nexus S, how would an application provider request a Security Domain (SD) from Google? How would it be provisioned? Is Google building a Trusted Service Manager (TSM) to sell such a service? I haven’t got a clue. The guys told me (these are edited highlights, by the way)…

In J2ME, it’s typically the SE issuer (ie, Google, in this instance) that decides who can access the SE from apps in the phone, and sets up the access conditions on the SE to manage this (the ACF file). Essentially, what we need the Android stack to do is deliver what J2ME (and it’s JSRs) have been doing for several years now. That is, include APIs that provide the app with a mechanism to access an applet in the SE, and for Android to interact with the SE to manage access condition verification. You can’t block the SE if you can’t access it!…

…These comments from Google make it sound like Google won’t be doing anything with card emulation any time soon. If that’s the case, then what’s with all these stories about Google trialling contactless card payments in SF with MasterCard and Citibank, uing Verifone and Ingenico POS terminals? These POS terminals implement 14443 to read contactless cards, and I doubt that Google are going to develop custom terminals that implement P2P ISO 18000 instead. But who knows – it would be cool if they did…

…Perhaps the Android stack doesn’t need to implement card emulation mode if the underlying hardware implements it, i.e. if the NFC controller and SE together support 14443 and card emulation mode, then they can talk to the reader via the antenna independent of the Android stack. The stack needs to provide an access API to allow phone apps to access applets over the contact interface (if there is one, e.g. SIM), or the wired interface for embedded, or via the SD interface….

…So perhaps there is no need for a card emulation stack in Android after all? But we still need ot be able to switch the PN544 into card emulation mode and an SE access API supporting a decent access control mechanism…

That’s the actual problem, then. Developers can get to the SE interface but they can’t do anything with it (eg, load a payment card into it).

As of the 2.3.3 release of Gingerbread the Secure Element functionality has been enabled (but the API Hidden). You can confirm that there is a Secure Element (SmartMX) in the Nexus S just by looking at the debug log using adb logcat and switching on NFC via settings… That said I’m assuming that the keys etc are controlled by Google so actually doing anything with the embedded SE will be difficult/impossible at the moment.

[From Secure Element - SmartMX - seek-for-android | Google Groups]

What has happened is that Google used an NXP NFC stack when building the Android operating system image for the Nexus S, but switched off the card emulation using compiler switches. (There’s nothing to stop you, by the way, from recompiling the stack with those switches set to allow card emulation.) My interim conclusion is, then, that I have no idea what is going on. I don’t understand what Google mean and I don’t see how they can stop anyone from accessing secure elements. Sure, they can stop you for doing anything with the embedded SE (theirs) by not giving out any keys, but if there’s a UICC SE (from the operator) you can access that and if there’s an external SE (eg, a DeviceFidelity SD card) you can access that. If there’s no Google Android API elements for any of these, someone else can simply add their own.

After all, Google ordered the Nexus S with embedded secure chips, the PN65 from NXP Semiconductors, which can store applications. The NFC controllers in the phones also support applications for card emulation on SIM cards.

[From Card Emulation Expected Soon Despite Doubts from Google Engineers | NFC Times – Near Field Communication and all contactless technology.]

Indeed. So why the fuss? What does it matter whether Google want to provide card emulation APIs or not? The things is that Google’s opinions about NFC have taken on more and more significance recently as it has become clear that whatever mobile operators and banks may think about NFC, Google thinks that it is important and will drive it into the marketplace.

Google has obviously made a decision that NFC is an opening into something more interesting and lucrative than transforming a phone into a payment card– advertising and marketing opportunities at the point of sale – the physical point of sale. And, it has done a deal with VeriFone that takes the economic sting away from the merchants who need to buy into their vision to make it work – and who have by and large turned their noses up at NFC up to this point. Layer on top of that their Google Checkout asset and their newly launched One-Pass wallet application and you have the makings of an interesting new payments player.

[From Google Takes on NFC, Will They Crack the Code? at The Catalyst Code]

Karen is, as usual, spot on with this analysis. But I’m not so sure about this…

What’s amazing is that Google was the first to connect all of these dots

[From Google Takes on NFC, Will They Crack the Code? at The Catalyst Code]

This doesn’t seem amazing to me, because I’ve been involved in numerous attempts to develop mobile proximity payments for banks and operators. A month before the Google announcement, I wrote on Quora that “I’m sure [loyalty and rewards] will be Google’s strategy too. Payments are not an interesting enough application to persuade people to go out an get an NFC phone.” Years ago, I made a presentation (I think at NFC World but I can’t find it!) in which I said that no consumers will go into retail outlets and buy an NFC phone because of payments. They will buy the NFC phone so that they can read tags, swap Facebook profiles or (now, it seems) play proximity Angry Birds. But once they have that handset, then we need to make it easy and attractive for them to use it for payments.

Incidentally, Dean Bubley, who is in my opinion one of the very best analysts out there, called these non-payment applications “valueless” in a twitter exchange. He’s referring to things like “0-click” checkins and similar.

Starting tomorrow, just tap your NFC-enabled phone (most newer Android devices have it) against the poster, it’ll check you in with foursquare

[From Experimenting with NFC check-ins for Google I/O | Foursquare Blog]

I’m convinced that valueless is the wrong word. If Google (or Apple) or whoever track where you are via mobile location and then send you special offers, it’s creepy. But if you reach out tap when you enter the shop, or restaurant, or hotel, or office, that’s what advertising folk label “a call to action” that gives them permission to send you things, to steer you, to deliver added value. That’s what retailers will pay for — they’ll get the payments part for free — and that’s why the ecosystem will deliver real value.

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Prepaid could be a great product, if it worked better

by 1 Comment

At the risk of turning into the� Victor Meldrew of retail payments, I want to make a point about something. When I wrote about some bad experiences with contactless a couple of weeks ago, I did it because I genuinely care about this stuff, and I genuinely want the contactless experience to get better. I don’t think the blog would be useful, particularly to my colleagues in the industry who read it, if it never contained criticism, so long as that criticism is well-founded and honest. Similarly with prepaid. I really like prepaid, I really want it to succeed and I really get upset when it doesn’t work as well as it should.

Prepaid is growing. In the last five years, the volume of card transactions in Europe has grown about 9% per annum but the value has grown 7% per annum (because the average transaction size has fallen) and most of that growth has actually come from prepaid cards [F. Burelli. “Profitability dynamics of card payments” in Nordic Card Markets, Stockholm (Jan. 2010)]. Looking forward, the outlook appears to be pretty rosy. Yet I can’t help feeling that prepaid isn’t where it should be. My recent experiences with prepaid have been pretty good. I had a Visa prepaid card (which has just expired) that we were using as our “house” card at home: the kids used it when they needed to run to the supermarket or buy stuff for school. It had a simple web interface, I could see what they had been spending the money on and I could easily top it up from my debit card. Best of all, it didn’t have a name on it, so if they lost it then no-one could use it in shops (because it’s a chip and PIN card) or online (because they wouldn’t know the name or address associated with the card). Now that it’s expired, I got my eldest to go and get an Orange Cash card which annoyingly has a name on it (review to be posted shortly), so we’ll see if that can take over as house card.

But I digress. Right now, I am annoyed with prepaid. Just as I was leaving for the airport, I remembered that I had less than $100 on my Travelex US Dollar prepaid card. As I was going to be in the US for a few days, I’d need a bit more to cover meals etc so I decided to load a couple of hundred more dollars. Now, obviously I wasn’t going to bother to do that at the airport given the palaver I went through last time: I had £50 in cash in my pocket and I stopped at a Travelex booth in Heathrow to add it to my card and it took about a quarter of an hour and involved taking photocopies of my passport, the card, the receipt as well as answering security questions. The process was, presumably, designed to drive up the cost of prepaid cards to keep them beyond the reach of the poor.

Naturally, I thought that there would be some way to top up online, so I entered my 16-digit card number, my username and password and logged in to my cash passport account, only to find that there is no option for reloading (only for changing PIN and looking at transaction history). I went back to the home page and found that there’s a separate option for reloading, I clicked that, and was asked to enter the first six digits of my card number. This took me back to the account screen. I went back round again, and somehow found another link (I can’t remember what it was now) that asked my for the first six digits again and then took me to a reload screen. I entered the number of my Visa card, my address, the CVV and the amount, and was met with a screen saying tough luck.

Screen shot 2011-05-02 at 12.24.53

I wondered if it might be something to do with credit vs. debit, so I went round the loop again, this time using my Visa debit card instead. After typing in the amount, card number, address, CVV again, I got the same results. Much against my better judgement I decided to call, so I phoned the (mercifully) free phone number on the back of the card. I stupidly chose the option for speaking to an operator, and the line just went dead. So I dialled back and chose account services and then something else and then talk to an operator. I was shocked when a woman answered. After giving her my (I’m not making this up) card numbers, address, name, date of birth and a couple of other things, she put me through to another chap who said he would top up the card. I asked him if it was possible to do it via home banking and he said that it was and that he would e-mail me the details. After asking some more security questions, I started to give him my debit card number and he stopped me and said that he first had to check whether I was on the electoral roll at that address. I gave up, grabbed my BA Amex card and my John Lewis MasterCard and my Visa OnePulse and jumped in the cab.

All the way to the airport I was wondering why it was all so complicated. Why can’t I load via the ATMs at the airport, or using an app on my iPhone or by PayPal. Prepaid should be a simple, inexpensive alternative to cash, not something that has you jumping through hoops! When I got the US, I decided to get another prepaid US$ card, but this time I would register it in the US so that I could have a US BIN and billing address (some stores, such as Levenger, will let you ship internationally but will only accept payment from cards with a US billing address). Although in the end I didn’t have time, because I got sidetracked playing with my new Square, this does illustrate (once again) that there are lots of good reasons for wanting prepaid cards that are nothing to do with not being able to get a credit or debit card.

From the consumer side, prepaid allows consumers to test new opportunities and options without risking a lot of money or putting their bank accounts or credit cards on the line.

[From� PaymentsJournal - When It Comes to New Payments Technology, Prepaid Will Lead the Way]

This is a good point, but I feel there’s another reason for thinking that prepaid will be developing in interesting directions, at least in Europe. You don’t need to be a bank to offer prepaid services: the combination of an Electronic Money Institution Licence (ELMI) and a Payment Institution Licence (PI) means that any company can offer a full service: an open-loop prepaid card. I suspect that many of the companies applying for these licences are doing so because they want to use new technology to deliver new services that need payment, if you see what I mean. That is, they don’t expect to earn money from the payments themselves, but from the value-added services that need the payments to take place.

I’ll be looking out for trends around value-added at this year’s� Prepaid Conference in London on 13th-15th June and I look forward to meeting you all there too.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Prepaid could be, should be, great

by 6 Comments

At the risk of turning into the Victor Meldrew of retail payments, I want to make a point about something. When I wrote about some bad experiences with contactless a couple of weeks ago, I did it because I genuinely care about this stuff, and I genuinely want the contactless experience to get better. I don’t think the blog would be useful, particularly to my colleagues in the industry who read it, if it never contained criticism, so long as that criticism is well-founded and honest. Similarly with prepaid. I really like prepaid, I really want it to succeed and I really get upset when it doesn’t work as well as it should.

Prepaid is growing. In the last five years, the volume of card transactions in Europe has grown about 9% per annum but the value has grown 7% per annum (because the average transaction size has fallen) and most of that growth has actually come from prepaid cards [F. Burelli. "Profitability dynamics of card payments" in Nordic Card Markets, Stockholm (Jan. 2010)]. Looking forward, the outlook appears to be pretty rosy. Yet I can’t help feeling that prepaid isn’t where it should be. My recent experiences with prepaid have been pretty good. I had a Visa prepaid card (which has just expired) that we were using as our “house” card at home: the kids used it when they needed to run to the supermarket or buy stuff for school. It had a simple web interface, I could see what they had been spending the money on and I could easily top it up from my debit card. Best of all, it didn’t have a name on it, so if they lost it then no-one could use it in shops (because it’s a chip and PIN card) or online (because they wouldn’t know the name or address associated with the card). Now that it’s expired, I got my eldest to go and get an Orange Cash card which annoyingly has a name on it (review to be posted shortly), so we’ll see if that can take over as house card.

But I digress. Right now, I am annoyed with prepaid. Just as I was leaving for the airport, I remembered that I had less than $100 on my Travelex US Dollar prepaid card. As I was going to be in the US for a few days, I’d need a bit more to cover meals etc so I decided to load a couple of hundred more dollars. Now, obviously I wasn’t going to bother to do that at the airport given the palaver I went through last time: I had £50 in cash in my pocket and I stopped at a Travelex booth in Heathrow to add it to my card and it took about a quarter of an hour and involved taking photocopies of my passport, the card, the receipt as well as answering security questions. The process was, presumably, designed to drive up the cost of prepaid cards to keep them beyond the reach of the poor.

Naturally, I thought that there would be some way to top up online, so I entered my 16-digit card number, my username and password and logged in to my cash passport account, only to find that there is no option for reloading (only for changing PIN and looking at transaction history). I went back to the home page and found that there’s a separate option for reloading, I clicked that, and was asked to enter the first six digits of my card number. This took me back to the account screen. I went back round again, and somehow found another link (I can’t remember what it was now) that asked my for the first six digits again and then took me to a reload screen. I entered the number of my Visa card, my address, the CVV and the amount, and was met with a screen saying tough luck.

Screen shot 2011-05-02 at 12.24.53

I wondered if it might be something to do with credit vs. debit, so I went round the loop again, this time using my Visa debit card instead. After typing in the amount, card number, address, CVV again, I got the same results. Much against my better judgement I decided to call, so I phoned the (mercifully) free phone number on the back of the card. I stupidly chose the option for speaking to an operator, and the line just went dead. So I dialled back and chose account services and then something else and then talk to an operator. I was shocked when a woman answered. After giving her my (I’m not making this up) card numbers, address, name, date of birth and a couple of other things, she put me through to another chap who said he would top up the card. I asked him if it was possible to do it via home banking and he said that it was and that he would e-mail me the details. After asking some more security questions, I started to give him my debit card number and he stopped me and said that he first had to check whether I was on the electoral roll at that address. I gave up, grabbed my BA Amex card and my John Lewis MasterCard and my Visa OnePulse and jumped in the cab.

All the way to the airport I was wondering why it was all so complicated. Why can’t I load via the ATMs at the airport, or using an app on my iPhone or by PayPal. Prepaid should be a simple, inexpensive alternative to cash, not something that has you jumping through hoops! When I got the US, I decided to get another prepaid US$ card, but this time I would register it in the US so that I could have a US BIN and billing address (some stores, such as Levenger, will let you ship internationally but will only accept payment from cards with a US billing address). Although in the end I didn’t have time, because I got sidetracked playing with my new Square, this does illustrate (once again) that there are lots of good reasons for wanting prepaid cards that are nothing to do with not being able to get a credit or debit card.

From the consumer side, prepaid allows consumers to test new opportunities and options without risking a lot of money or putting their bank accounts or credit cards on the line.

[From PaymentsJournal - When It Comes to New Payments Technology, Prepaid Will Lead the Way]

This is a good point, but I feel there’s another reason for thinking that prepaid will be developing in interesting directions, at least in Europe. You don’t need to be a bank to offer prepaid services: the combination of an Electronic Money Institution Licence (ELMI) and a Payment Institution Licence (PI) means that any company can offer a full service: an open-loop prepaid card. I suspect that many of the companies applying for these licences are doing so because they want to use new technology to deliver new services that need payment, if you see what I mean. That is, they don’t expect to earn money from the payments themselves, but from the value-added services that need the payments to take place.

I’ll be looking out for trends around value-added at this year’s Prepaid Conference in London on 13th-15th June 2011. In an act of magnificent generosity, the wonderful people at Clarion have given me a delegate pass for the conference — worth an amazing ONE THOUSAND FOUR HUNDRED AND NINETY FIVE POUNDS — to give away on this blog as a competition prize. So if you are going to be in London on those dates and you’d like to come along to meet practitioners, thought leaders and me, then all you have to do is be the first person to respond to this post telling me what the conference sponsors MasterCard were originally called when they started in 1966.

In the traditional fashion, this competition is open to all except for employees of Consult Hyperion and members of my immediate family, is void where prohibited and has been designed to be carbon neutral. The prize must be claimed within three months. Oh, and no-one can win more than one of the Digital Money Blog prizes per calendar year.

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Improving authentication in the mass market using two, three (and four?) factors

by Leave a Comment

I had an� annoying problem with my PayPal account that ended up with me being posted a password, all quite tedious and strangely manual. As I observed at the time, it seemed odd that in 2011 we hadn’t got anything figured out when it comes to authentication. Why couldn’t I use my Barclays 2FA PINSentry to prove who I was to PayPal? In fact, why couldn’t I use it for 2FA in general, since moving from passwords to 2FA involving tamper-resistant hardware would be a simple way to improve security across a range of services. We don’t use 2FA, and we should.

But that might be changing [recently] Google launched two-factor authentication for Google Accounts—the credentials you use to log in to all Google services, including Gmail.

[From� Two-factor authentication: Gmail’s new system offers more security than just a password. - By Farhad Manjoo - Slate Magazine]

This is a good step. I use gmail, and I’d actually prefer to use it with 2FA than without, provided that the 2FA is based on something I already have, such as my phone, because I don’t want to carry another dongle. Unfortunately, my mobile operator doesn’t provide any sort of identity management or authentication services, so I can’t use my phone. I do already have a tamper-resistant chip that I have with me most of the time, and that’s in my bank card. Why not use that in some way?

Alternatively, you could slide your credit card through your phone’s card reader—or simply wave your credit card so that it can be recognized by the “near-field communication” chip in your phone.
Are these things too far out?

[From� Two-factor authentication: Gmail’s new system offers more security than just a password. - By Farhad Manjoo - Slate Magazine]

I’d say not really, especially since I’ve seen� SecureKey‘s system for doing just this work perfectly with Google, using a USB key NFC reader and the customer’s contactless bank card to provide the second factor. Today I read about someone pitching iris recognition via USB device as a potential third factor as well. But are three factors enough?

I saw a discussion over at the� Identity Management Specialists Group on LinkedIn that set me wondering about authentication factors. Traditionally, us experts have referred to three authentication factors: something you know, something you have and something you are (or, as Ben Laurie once told me, something you’ve forgotten, something you’ve lost and something you were). The LinkedIn discussion was about whether location might be a fourth authentication factor, because it is independent of the other three and can be determined in isolation.

So does this make sense? Is location an alternative third factor, another kind of “something you are” or is it genuinely something new that adds an additional degree of authentication power. The conclusion in the group discussion was (I think!) that location isn’t an authentication factor because where you are doesn’t change who you are, but that it is an authorisation factor because you may wish to assign different capabilities to an identity depending on where the physical person is (ie, are they in the office or at home?). I’m not so sure about this: it seems to me that corroborating your location obtained from your mobile phone with, say, a password, does indeed strengthen authentication. There are plenty of options, so a workable strong authentication scheme must be getting closer. right?

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

25% increase in authentication

by 2 Comments

I had an annoying problem with my PayPal account that ended up with me being posted a password, all quite tedious and strangely manual. As I observed at the time, it seemed odd that in 2011 we hadn’t got anything figured out when it comes to authentication. Why couldn’t I use my Barclays 2FA PINSentry to prove who I was to PayPal? In fact, why couldn’t I use it for 2FA in general, since moving from passwords to 2FA involving tamper-resistant hardware would be a simple way to improve security across a range of services. We don’t use 2FA, and we should.

But that might be changing [recently] Google launched two-factor authentication for Google Accounts—the credentials you use to log in to all Google services, including Gmail.

[From Two-factor authentication: Gmail's new system offers more security than just a password. - By Farhad Manjoo - Slate Magazine]

This is a good step. I use gmail, and I’d actually prefer to use it with 2FA than without, provided that the 2FA is based on something I already have, such as my phone, because I don’t want to carry another dongle. Unfortunately, my mobile operator doesn’t provide any sort of identity management or authentication services, so I can’t use my phone. I do already have a tamper-resistant chip that I have with me most of the time, and that’s in my bank card. Why not use that in some way?

Alternatively, you could slide your credit card through your phone’s card reader—or simply wave your credit card so that it can be recognized by the “near-field communication” chip in your phone.
Are these things too far out?

[From Two-factor authentication: Gmail's new system offers more security than just a password. - By Farhad Manjoo - Slate Magazine]

I’d say not really, especially since I’ve seen SecureKey‘s system for doing just this work perfectly with Google, using a USB key NFC reader and the customer’s contactless bank card to provide the second factor. Today I read about someone pitching iris recognition via USB device as a potential third factor as well. But are three factors enough?

I saw a discussion over at the Identity Management Specialists Group on LinkedIn that set me wondering about authentication factors. Traditionally, us experts have referred to three authentication factors: something you know, something you have and something you are (or, as Ben Laurie once told me, something you’ve forgotten, something you’ve lost and something you were). The LinkedIn discussion was about whether location might be a fourth authentication factor, because it is independent of the other three and can be determined in isolation.

So does this make sense? Is location an alternative third factor, another kind of “something you are” or is it genuinely something new that adds an additional degree of authentication power. The conclusion in the group discussion was (I think!) that location isn’t an authentication factor because where you are doesn’t change who you are, but that it is an authorisation factor because you may wish to assign different capabilities to an identity depending on where the physical person is (ie, are they in the office or at home?). I’m not so sure about this: it seems to me that corroborating your location obtained from your mobile phone with, say, a password, does indeed strengthen authentication. There are plenty of options, so a workable strong authentication scheme must be getting closer. right?

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Games are quite a serious business

by Leave a Comment

It was obvious a few years ago that not only were virtual worlds going to be big business, but that they would have an impact on the payments market. I used put things like� World of Warcraft into product and service roadmap discussions for our clients in the financial services space, and I’m sure that they thought I was doing it just for fun, just to get some discussion going. But having played around in the space, I could see it would lead to some new thinking. When you’re sending World of Warcraft gold pieces to a friend in Asia via an elven intermediary (quicker and cheaper than banks, by the way) you can’t help but wonder at the “real world” instruments to hand. This from three years ago…

Well it wouldn’t surprise anyone then, that most of our partners report they have a completion rate of 0.5-1% when they present a credit card payment page to their users for virtual goods…Mobile on the other hand… takes 15 seconds, and off goes the user to his virtual good or points that will enhance his game or app experience immediately without ever leaving the environment of the app.

[From� Virtual Goods / Currency and Mobile Payments: the business model for Social Apps]

Note that figure: one in a hundred transactions complete. People playing at being virtual farmers want to buy some virtual cows, so they click to buy, but when they see a credit card payment screen, they can’t be bothered. So there was a demand for a new kind of payment instrument that was not being met by the banks. Look how much things have changed since then, with the incredible boom in app store and in-game payments. There’s no doubt that the retail payments roadmap is indeed being affected by the world of games.

Now I’m not implying that it’s only payments will be impacted, because in the longer run it will be many kinds of financial service, including banking.

The publisher of the online science-fiction game “Entropia Universe,” set on the planet Calypso, received a banking license from the Swedish Financial Supervisory Authority last week and plans to open a real bank within a year, albeit one without physical, walk-in branches.

Players of “Entropia” already exchange real money for a virtual currency that is used for their expenses on Calypso. And virtual money they make in the game, through hunting, mining, trading or other activities, can be cashed out into real money. The virtual currency, Project Entropia Dollars, has a fixed 10-to-1 exchange rate to the U.S. dollar.

By setting up a real-world bank, Sweden-based publisher MindArk PE AB gains the protection of the Swedish government’s deposit insurance for these accounts, up to about $60,000 for each customer.

[From� The Associated Press: Online game gets real-world banking license]

A healthy development! My younger son spends a lot of time online with his friends at the moment, hanging out not at the mall but at the WoW auction house (this is where he learns about economics, I’m happy to say). That’s where our clients’ next generation of customers are learning about money, payments and financial services. This from two years ago…

Today, Facebook application developers monetize their games and other applications by accepting payment directly using PayPal, Google, Amazon FPS, or SocialGold. Or developers may opt to receive direct payment via mobile phone via Zong, Boku, or another mobile payment provider… game developers in particular, often accept payment via a prepaid card sold in retail establishments, such as the Ultimate Game Card. The social and gaming web is exploding with virtual currency offerings, yet thus far no one model or payment brand dominates.

[From� Purchasing Facebook Credits with Zong Mobile Payments — Payments Views from Glenbrook Partners]

Now, forward-looking organisations could see what was going on and began to target R&D appropriately.

Google is developing a micropayment platform that will be “available to both Google and non-Google properties within the next year,”… The system, an extension of Google Checkout, would be a new and unexpected option for the news industry as it considers how to charge for content online.

[From� Google developing a micropayment platform and pitching newspapers: “‘Open’ need not mean free” » Nieman Journalism Lab]

The idea was then that micropayments would be a payment vehicle available to both Google and non-Google properties within the year. The idea was to allow viable payments of a penny to several dollars by aggregating purchases across merchants and over time. Google planned to mitigate the risk of non-payment by assigning credit limits based on past purchasing behavior and having credit card instruments on file for those with higher credit limits and using proprietary risk engines to track abuse or fraud. Merchant integration through Checkout would be extremely simple. Google, in fact, subsequently decided to purchase an in-game payments company rather than build it themselves.

Facebook and Google are poised to challenge the banking industry in online payments.

[From� Facebook and Google Encroach on Banks Turf - US Banker Article]

Is this really true? I think the answer is yes and no, in the sense that I can’t see any reason why Facebook or Google would want to be a bank, unless it’s to get some sort of government handout, but I can see why they might want to get involved in payments in order to make money (not from the payments, where margins are thin, but from new products and services that have payments integral to them). This is why the news that Facebook had also begun experimenting with a payment system was hardly unexpected, but was notable nonetheless. There was an expectation that the existence of a secure and convenient micropayment scheme for Facebook users (of which there now more than 600 million) would stimulate the development of a new marketplace within Facebook’s “barbed wire”. This seemed plausible to me—if it had been up to me, I would have added a spurious green element to the proposition somehow (getting merchants and other organisations to give out Facebook credits to reward environmentally desirable behaviour)—and I was sure it would do well. I wondered in a number of forums as to who else might enter this more competitive currency market?

In the coming months, facebook users will be able to obtain facebook Credits using MOL points purchased through MOL’s network of more than 500,000 outlets, which are mainly in Malaysia, Singapore, Indonesia, Philippines, Thailand, India, Australia and New Zealand. In addition to outlets such as 7-Eleven stores and cybercafes, customers will be able to purchase Credits through MOL’s network of online banks in these countries.

[From� Finextra: Facebook moves virtual currency offline]

I gave a talk last year when I mentioned that I thought that Facebook credits would become the biggest virtual currency in the world fairly quickly. Unusually for my glib and sweeping predictions from the conference platform, this one appears to have come true, and even more quickly than I had imagined.

By the end of the year, Facebook expects that Credits will be used to buy the vast majority of virtual goods sold on Facebook. The fast-growing market is expected to reach $835 million on Facebook this year, according to the Inside Network… Through Credits, Facebook will take a 30 percent cut… To bolster that market, Facebook began selling Credits gift cards at Target stores across the country this month.

[From� Facebook Promotes Its Credits as Path to Dollars - NYTimes.com]

Now this will one day become a standard business school case study. Talking of which, a few years ago, as part of a course I was teaching at Visa’s Bank Card Business School, a colleague and I mocked up a future Visa card that drew on a World of Warcraft account rather than a fiat currency account. This was photoshopped up to make a point, and at the time it was supposed to be a totally out-of-the-box crazy picture of the future. About two weeks after we made it up, I read that a US bank was issuing a Visa card with cashback in World of Warcraft gold. Oh well. It did help to make one of the points that I was trying to get across, which is that the future of payments will extend beyond the “traditional” bank, consumer, merchant and acquirer for 4-party model.

Vegetable company Green Giant is offering an unlikely reward for purchasing their products: virtual currency in Zynga’s hit social game FarmVille.

[From� Wacky: Zynga Gives Away Free FarmVille Cash With Purchases Of Real Life Vegetables]

That was bad timing, coming just as Zynga (the people behind Farmville) caved in to Facebook and agreed to replace Farmville cash with Facebook credits, but it was an interesting development nonetheless, showing that virtual money is just as valuable as “real” money. Facebook’s tactics show they undoubtedly have a strategy in this field.

First Facebook turned off notifications for applications, taking away the primary mechanism for social games to go viral. Now if a company wants a massive audience for a new game, they almost certainly have to buy it through Facebook advertising.

Now Facebook is rolling out Credits as the preferred method of payment for games on their Platform, and taking a 30 per cent cut of the transactions. That’s a much larger percentage than the social games companies were handing over to the small payment companies that had sprung up to fill this niche, and higher than the fees charged by PayPal and credit card companies.

[From� Zynga says it’s not leaving Facebook | Tech Blog | FT.com]

Now there’s something to be said for the creation of a single currency area as a way to encourage trade and therefore prosperity.

Besides leading the creation of a more people-centric web, it could also end up having the dominant virtual currency, according to an early adopter of Facebook Credits. PopCap Games has been using the service, which is still in the beta testing phase, as the sole payment method for Bejeweled Blitz on Facebook.

The game is free to play and attracts 11m monthly players, 3m of them playing it daily. PopCap sells extra power-ups, which boost players’ capabilities, and is moving onto sales of virtual items. It has decided to ignore offering other virtual currency options and only accepts Facebook Credits. Users can buy them with credit cards, Paypal or through their mobile phones in $5, $10 and $20 increments for 50, 100 or 200 Credits.

[From� Facebook’s Credits Bank of the Web | Tech Blog | FT.com]

These are all useful case studies, showing how a new currency can develop and evolve.

Facebook has certainly tried to guide the development of its online economy, almost in the way that governments seek to influence economic activity in the real world, through fiscal and monetary policy. Earlier this year the firm said it wanted applications running on its platform to accept its virtual currency, known as Facebook Credits. It argued that this was in the interests of Facebook users, who would no longer have to use different online currencies for different applications.

[From� Social networks and statehood | The future is another country | Economist.com]

I think I’ve seen the playbook before.

That means all Facebook game developers will be able to start using Credits as their payment system for virtual goods — in fact, Facebook is requiring them to make the switch by July

[From� All Facebook Games Will Have To Use Facebook Credits Starting In July]

This comes from the Great Khan’s playbook for monetary and fiscal policy. Not Genghis Khan. His fiscal policy was confused: when he took control of China in 1215, his pacification plan was to kill everyone in China, no small undertaking since China was then, as now, the world’s most populous country. Fortunately, one of his advisors, a man who ought to be the patron saint of Finance Ministers everywhere, Yeliu Ch’uts’ai, pointed out (presumably via a primitive Treasury model of some sort) that dead peasants paid considerably less tax than live ones, and the plan was halted. In 1260, Genghis’ grandson Kublai Khan became Emporer of China. He decided, much as Mark Zuckerberg has, that it was a burden to commerce and taxation to have all sorts of currencies in use, ranging from copper “cash” to iron bars, to pearls to salt to specie, so he decided to implement a paper currency.

Here’s what Marco Polo had to say about it…

[From� Digital Money: Lucky, for me anyway]

His monetary policy was refreshingly straightforward and more robust, even, than Mr. Zukerberg’s: if you didn’t accept his money, he would kill you. Naturally, in a short time, the new single currency was established and paper money began to circulate instead of gold, jewels, copper coins and metal bars. If you think talking about a new currency is crazy, take a look at Facebook Deals. According to Facebook, at launch, you will not be able to buy physical goods with Facebook Credits. Rather you will be able to get things like vouchers that you can redeem at events: now this is, frankly, a paper-thin distinction. I can’t use Facebook Credits to pay for, say, a Coke at a pop concert but I can use them to pay for a voucher for a Coke at a pop concert. I am not an economist, but…

When beloved national retailers start offering goods and lower prices to customers who pay with a new, virtual currency – that’s when said virtual currency becomes a force to reckon with. Somebody call Congress and the Federal Reserve – it’s time to start having some serious conversations.

[From� Facebook Deals Launches Tonight & Groupon Doesn’t Stand a Chance (Updated)]

There’s a warning from history here! Unfortunately, the Khan’s paper money ended in disaster because the money supply was not managed: it collapsed in hyperinflation, because in the days after Yeliu Ch’uts’ai, the temptation to print money was just too great for the monetary authorities too resist. Let’s hope that the Emperor of Facebook finds an advisor of the calibre of Yeliu Ch’uts’ai.

One possible future might be that, just as China turned in on itself and stagnated, leaving technological and commercial progress to other people, Facebook will become an inward-looking economy while others take up the torch! Perhaps competition in currency, not only in payment methods, is need to keep an economic space vital.

The new program, announced today at SXSW, is called RewardVille, which will give players zPoints and zCoins in CityVille, FrontierVille, FarmVille, Mafia Wars, Zynga Poker, Café World, Treasure Isle, YoVille, PetVille and Vampire Wars.

[From� Zynga Rolls Out New Virtual Currency in Addition to Facebook Credits | Tricia Duryee | eMoney | AllThingsD]

Competition. This is the American way, not going complaining to Senator Durbin.

These are personal opinions and should not be misunderstood as representing the opinions of
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Top and bottom

by Leave a Comment

I just applied for yet another credit card, this time because I fancied a contactless Amex ExpressPay card to play with (I already have contactless Visa PayWave and contactless MC PayPass cards). When I read this…

MBNA today announced that the first American Express-branded, contactless credit cards in the UK will be issued for use by MBNA’s customers.

[From MBNA introduces contactless Amex card in UK]

…naturally I couldn’t resist applying. The online process was pretty painless, I have to say, and my card is apparently going to arrive in 5-7 business days. Excellent. American Express marketing has been a bit of a theme for me recently. A few days ago the morning’s junk mail included a new special offer from American Express. Now, my British Airways American Express card is my top of wallet card, for about the first four months of the year. That’s because it gives you BA miles — which are not much of an incentive — and a free BA companion ticket — which is a great incentive — once you have spent £10,000 in a year. But you can only have one. So like, I’m sure, many other who travel on business, l spend £10,000 on the BA Amex card to get the companion ticket and then I go back to using my “Middle-Class Maestro”: the John Lewis MasterCard that I pay off in full every month. This delivers an excellent 1% cashback in the form of John Lewis vouchers that are valid in Waitrose.

Anyway, I got some junk mail from Amex which says that if I go and register my Amex card at some website and then use it in eight different stores before the end of June then… sorry, I lost interest at this point and threw it into the recycling bin. It was only when I got home in the evening after a meeting with a card marketing specialist today that I determined to retrieve it and read it. As it transpires, the offer was that if I go and register my card at a particular web site and then I use it in eight of the stores listed in the leaflet before the end of June then I get a bonus 2,400 BA miles. But surely, I thought, their computer would have noticed that I stopped using the card as soon as I had the companion ticket. If BA miles were an incentive to me, then I’d still be using it, so clearly they are not. The bottom line is that I don’t understand card marketing and have absolutely no idea what the marketing people are thinking about when they come up with their special promotions. For example…

KFC outlets have been promoting the cards, ranging in value from $10 to $500 and to be used within 12 months, as a “thoughtful gift idea for any occasion”… Preventative Health Taskforce chair Professor Rob Moodie said he was shocked when he learned about KFC’s latest marketing ploy. “It’s marketing gone berserk,” he said.

[From Fury over $500 KFC gift cards as nation battles obesity crisis | News.com.au]

Personally, I think that marketing may well have started off beserk, but I get his point.

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

They’re not playing games

by Leave a Comment

It was obvious a few years ago that not only were virtual worlds going to be big business, but that they would have an impact on the payments market. I used put things like World of Warcraft into product and service roadmap discussions for our clients in the financial services space, and I’m sure that they thought I was doing it just for fun, just to get some discussion going. But having played around in the space, I could see it would lead to some new thinking. When you’re sending World of Warcraft gold pieces to a friend in Asia via an elven intermediary (quicker and cheaper than banks, by the way) you can’t help but wonder at the “real world” instruments to hand. This from three years ago…

Well it wouldn’t surprise anyone then, that most of our partners report they have a completion rate of 0.5-1% when they present a credit card payment page to their users for virtual goods…Mobile on the other hand… takes 15 seconds, and off goes the user to his virtual good or points that will enhance his game or app experience immediately without ever leaving the environment of the app.

[From Virtual Goods / Currency and Mobile Payments: the business model for Social Apps]

Note that figure: one in a hundred transactions complete. People playing at being virtual farmers want to buy some virtual cows, so they click to buy, but when they see a credit card payment screen, they can’t be bothered. So there was a demand for a new kind of payment instrument that was not being met by the banks. Look how much things have changed since then, with the incredible boom in app store and in-game payments. There’s no doubt that the retail payments roadmap is indeed being affected by the world of games.

Now I’m not implying that it’s only payments will be impacted, because in the longer run it will be many kinds of financial service, including banking.

The publisher of the online science-fiction game “Entropia Universe,” set on the planet Calypso, received a banking license from the Swedish Financial Supervisory Authority last week and plans to open a real bank within a year, albeit one without physical, walk-in branches.

Players of “Entropia” already exchange real money for a virtual currency that is used for their expenses on Calypso. And virtual money they make in the game, through hunting, mining, trading or other activities, can be cashed out into real money. The virtual currency, Project Entropia Dollars, has a fixed 10-to-1 exchange rate to the U.S. dollar.

By setting up a real-world bank, Sweden-based publisher MindArk PE AB gains the protection of the Swedish government’s deposit insurance for these accounts, up to about $60,000 for each customer.

[From The Associated Press: Online game gets real-world banking license]

A healthy development! My younger son spends a lot of time online with his friends at the moment, hanging out not at the mall but at the WoW auction house (this is where he learns about economics, I’m happy to say). That’s where our clients’ next generation of customers are learning about money, payments and financial services. This from two years ago…

Today, Facebook application developers monetize their games and other applications by accepting payment directly using PayPal, Google, Amazon FPS, or SocialGold. Or developers may opt to receive direct payment via mobile phone via Zong, Boku, or another mobile payment provider… game developers in particular, often accept payment via a prepaid card sold in retail establishments, such as the Ultimate Game Card. The social and gaming web is exploding with virtual currency offerings, yet thus far no one model or payment brand dominates.

[From Purchasing Facebook Credits with Zong Mobile Payments — Payments Views from Glenbrook Partners]

Now, forward-looking organisations could see what was going on and began to target R&D appropriately.

Google is developing a micropayment platform that will be “available to both Google and non-Google properties within the next year,”… The system, an extension of Google Checkout, would be a new and unexpected option for the news industry as it considers how to charge for content online.

[From Google developing a micropayment platform and pitching newspapers: “‘Open’ need not mean free” » Nieman Journalism Lab]

The idea was then that micropayments would be a payment vehicle available to both Google and non-Google properties within the year. The idea was to allow viable payments of a penny to several dollars by aggregating purchases across merchants and over time. Google planned to mitigate the risk of non-payment by assigning credit limits based on past purchasing behavior and having credit card instruments on file for those with higher credit limits and using proprietary risk engines to track abuse or fraud. Merchant integration through Checkout would be extremely simple. Google, in fact, subsequently decided to purchase an in-game payments company rather than build it themselves.

Facebook and Google are poised to challenge the banking industry in online payments.

[From Facebook and Google Encroach on Banks Turf - US Banker Article]

Is this really true? I think the answer is yes and no, in the sense that I can’t see any reason why Facebook or Google would want to be a bank, unless it’s to get some sort of government handout, but I can see why they might want to get involved in payments in order to make money (not from the payments, where margins are thin, but from new products and services that have payments integral to them). This is why the news that Facebook had also begun experimenting with a payment system was hardly unexpected, but was notable nonetheless. There was an expectation that the existence of a secure and convenient micropayment scheme for Facebook users (of which there now more than 600 million) would stimulate the development of a new marketplace within Facebook’s “barbed wire”. This seemed plausible to me — if it had been up to me, I would have added a spurious green element to the proposition somehow (getting merchants and other organisations to give out Facebook credits to reward environmentally desirable behaviour) — and I was sure it would do well. I wondered in a number of forums as to who else might enter this more competitive currency market?

In the coming months, facebook users will be able to obtain facebook Credits using MOL points purchased through MOL’s network of more than 500,000 outlets, which are mainly in Malaysia, Singapore, Indonesia, Philippines, Thailand, India, Australia and New Zealand. In addition to outlets such as 7-Eleven stores and cybercafes, customers will be able to purchase Credits through MOL’s network of online banks in these countries.

[From Finextra: Facebook moves virtual currency offline]

I gave a talk last year when I mentioned that I thought that Facebook credits would become the biggest virtual currency in the world fairly quickly. Unusually for my glib and sweeping predictions from the conference platform, this one appears to have come true, and even more quickly than I had imagined.

By the end of the year, Facebook expects that Credits will be used to buy the vast majority of virtual goods sold on Facebook. The fast-growing market is expected to reach $835 million on Facebook this year, according to the Inside Network… Through Credits, Facebook will take a 30 percent cut… To bolster that market, Facebook began selling Credits gift cards at Target stores across the country this month.

[From Facebook Promotes Its Credits as Path to Dollars - NYTimes.com]

Now this will one day become a standard business school case study. Talking of which, a few years ago, as part of a course I was teaching at Visa’s Bank Card Business School, a colleague and I mocked up a future Visa card that drew on a World of Warcraft account rather than a fiat currency account. This was photoshopped up to make a point, and at the time it was supposed to be a totally out-of-the-box crazy picture of the future. About two weeks after we made it up, I read that a US bank was issuing a Visa card with cashback in World of Warcraft gold. Oh well. It did help to make one of the points that I was trying to get across, which is that the future of payments will extend beyond the “traditional” bank, consumer, merchant and acquirer for 4-party model.

Vegetable company Green Giant is offering an unlikely reward for purchasing their products: virtual currency in Zynga’s hit social game FarmVille.

[From Wacky: Zynga Gives Away Free FarmVille Cash With Purchases Of Real Life Vegetables]

That was bad timing, coming just as Zynga (the people behind Farmville) caved in to Facebook and agreed to replace Farmville cash with Facebook credits, but it was an interesting development nonetheless, showing that virtual money is just as valuable as “real” money. Facebook’s tactics show they undoubtedly have a strategy in this field.

First Facebook turned off notifications for applications, taking away the primary mechanism for social games to go viral. Now if a company wants a massive audience for a new game, they almost certainly have to buy it through Facebook advertising.

Now Facebook is rolling out Credits as the preferred method of payment for games on their Platform, and taking a 30 per cent cut of the transactions. That’s a much larger percentage than the social games companies were handing over to the small payment companies that had sprung up to fill this niche, and higher than the fees charged by PayPal and credit card companies.

[From Zynga says it’s not leaving Facebook | Tech Blog | FT.com]

Now there’s something to be said for the creation of a single currency area as a way to encourage trade and therefore prosperity.

Besides leading the creation of a more people-centric web, it could also end up having the dominant virtual currency, according to an early adopter of Facebook Credits. PopCap Games has been using the service, which is still in the beta testing phase, as the sole payment method for Bejeweled Blitz on Facebook.

The game is free to play and attracts 11m monthly players, 3m of them playing it daily. PopCap sells extra power-ups, which boost players’ capabilities, and is moving onto sales of virtual items. It has decided to ignore offering other virtual currency options and only accepts Facebook Credits. Users can buy them with credit cards, Paypal or through their mobile phones in $5, $10 and $20 increments for 50, 100 or 200 Credits.

[From Facebook’s Credits Bank of the Web | Tech Blog | FT.com]

These are all useful case studies, showing how a new currency can develop and evolve.

Facebook has certainly tried to guide the development of its online economy, almost in the way that governments seek to influence economic activity in the real world, through fiscal and monetary policy. Earlier this year the firm said it wanted applications running on its platform to accept its virtual currency, known as Facebook Credits. It argued that this was in the interests of Facebook users, who would no longer have to use different online currencies for different applications.

[From Social networks and statehood | The future is another country | Economist.com]

I think I’ve seen the playbook before.

That means all Facebook game developers will be able to start using Credits as their payment system for virtual goods — in fact, Facebook is requiring them to make the switch by July

[From All Facebook Games Will Have To Use Facebook Credits Starting In July]

This comes from the Great Khan’s playbook for monetary and fiscal policy. Not Genghis Khan. His fiscal policy was confused: when he took control of China in 1215, his pacification plan was to kill everyone in China, no small undertaking since China was then, as now, the world’s most populous country. Fortunately, one of his advisors, a man who ought to be the patron saint of Finance Ministers everywhere, Yeliu Ch’uts’ai, pointed out (presumably via a primitive Treasury model of some sort) that dead peasants paid considerably less tax than live ones, and the plan was halted. In 1260, Genghis’ grandson Kublai Khan became Emporer of China. He decided, much as Mark Zuckerberg has, that it was a burden to commerce and taxation to have all sorts of currencies in use, ranging from copper “cash” to iron bars, to pearls to salt to specie, so he decided to implement a paper currency.

Here’s what Marco Polo had to say about it…

[From Digital Money: Lucky, for me anyway]

His monetary policy was refreshingly straightforward and more robust, even, than Mr. Zukerberg’s: if you didn’t accept his money, he would kill you. Naturally, in a short time, the new single currency was established and paper money began to circulate instead of gold, jewels, copper coins and metal bars. If you think talking about a new currency is crazy, take a look at Facebook Deals. According to Facebook, at launch, you will not be able to buy physical goods with Facebook Credits. Rather you will be able to get things like vouchers that you can redeem at events: now this is, frankly, a paper-thin distinction. I can’t use Facebook Credits to pay for, say, a Coke at a pop concert but I can use them to pay for a voucher for a Coke at a pop concert. I am not an economist, but…

When beloved national retailers start offering goods and lower prices to customers who pay with a new, virtual currency – that’s when said virtual currency becomes a force to reckon with. Somebody call Congress and the Federal Reserve – it’s time to start having some serious conversations.

[From Facebook Deals Launches Tonight & Groupon Doesn't Stand a Chance (Updated)]

There’s a warning from history here! Unfortunately, the Khan’s paper money ended in disaster because the money supply was not managed: it collapsed in hyperinflation, because in the days after Yeliu Ch’uts’ai, the temptation to print money was just too great for the monetary authorities too resist. Let’s hope that the Emperor of Facebook finds an advisor of the calibre of Yeliu Ch’uts’ai.

One possible future might be that, just as China turned in on itself and stagnated, leaving technological and commercial progress to other people, Facebook will become an inward-looking economy while others take up the torch! Perhaps competition in currency, not only in payment methods, is need to keep an economic space vital.

The new program, announced today at SXSW, is called RewardVille, which will give players zPoints and zCoins in CityVille, FrontierVille, FarmVille, Mafia Wars, Zynga Poker, Café World, Treasure Isle, YoVille, PetVille and Vampire Wars.

[From Zynga Rolls Out New Virtual Currency in Addition to Facebook Credits | Tricia Duryee | eMoney | AllThingsD]

Competition. This is the American way, not going complaining to Senator Durbin.

These opinions are my own (I think) and presented solely in my capacity as an interested member of the general public [posted with ecto]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.