Archives for April 2007

Extending debit

Sunday, 29 April 2007 by Dave Birch

[Dave Birch] Our good friends at Edgar Dunn have produced a study showing that more consumers prefer debit cards than any other type of payment for point of sale purchases for the first time. So it looks as if the march of debit at POS continues. It may well continue beyond POS as well now that the the Star EFT network plans to start testing PIN-less online debit payments. The test will run about four months and involves Solana Corp., which will act as an aggregator of $25-and-under transactions generated by the online merchants. The idea is that customers can buy digital junk like ring tones or cartoon subscriptions from PCs. Through Solana, participating merchants will be required to register and authenticate consumers for the payments and bear the risk in disputed transactions. If they are happy to do this, then presumably the consumer preference for debit will begin to extend into cyberpsace. It looks as if debit cards are set to displace cash even further, with PINless transactions to eat into virtual cash transactions and contactless interfaces to eat into real world cash transactions.

Technorati Tags: cashless, debit cards, coins

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Identity and government identity

Friday, 27 April 2007 by Dave Birch

[Dave Birch] I can testify to the fact the the IRIS system at Heathrow was broken again this week. I’ve been flying quite a bit recently, and I can’t actually remember the last time that it was working. Surely one of the fundamental problems — as people like me are always saying — is that it is doing a 1:N match against a central database instead of a 1:1 match against a local token (such as an e-passport, which they are already issuing but without any useful functionality for citizens). Whenever the communications get interrupted or the central database crashes, the whole scheme is out. Anyway, I was mildly annoyed this time because I had to stand in an even bigger line than usual to get through UK passport control and I was in a hurry because the plane was late arriving. I did consider pretending to be an asylum seeker from Madeupistan, because I thought that line looked shorter, but in the end I just stood in line and waited and fumed.

Technorati Tags: biometrics, government, passport

[Read more…]

Card fraud in the UK

Thursday, 26 April 2007 by Dave Birch

[Dave Birch] Following from Paul Marsh of APACS, I thought I’d post a few figures. The basic UK picture is that online banking crime is going up while card and cheque fraud is falling. The APACS figures that Paul was kind enough to discuss with us show that card fraud losses fell by three per cent in the past year to £428m, a decrease of nearly £80m over the past two years. But online banking fraud is up 44% from £23.2m in 2005 to £33.5m in 2006. As had been hoped, chip & PIN has reduced card fraud at POS. As had been expected, some of this fraud has been displaced into Card-Not-Present (CNP) channels to the extent that CNP now accounts for half of all fraud. Fraud on UK cards overseas has increased because the stripes are counterfeited and the PINs are then used to withdraw cash at foreign (non-chip & PIN) ATMs. To put total fraud losses further into context, however, losses as a percentage of plastic card turnover are now below 10 basis points compared to 14 basis points before the chip & PIN migration. Cheque fraud fell by another quarter.

Technorati Tags: credit cards, debit cards, EMV, security

[Read more…]

Japanese lessons

Wednesday, 25 April 2007 by Dave Birch

[Dave Birch] Back looking at Japan again, but this time thinking about the non-bank entrants to the payment space, other than DoCoMo of course. There was a detailed story in Card Technology covering the transit side of things. Mobile Suica, the mobile version of the JR East Suica transit card, has got off to a slow start. There are 19 million of the contactless transit cards in circulation but after its first year only 350,000 people signed up for the mobile version. In addition to the mobile implementation, JR East have started to extend the e-purse usage to retailer, but there are only 10,000 POS locations in Tokyo where it can be used. Not for long, though, because JR East, DoCoMo, JCB and bitWallet have announced that they have agreed to share a common platform so that all of the payment brands (Suica, iD, QUICPay and Edy) will work in the same POS. There are currently about 100,000 contactless POS terminals in Japan.

Why the slow take up? Akio Shiibashi, director of the Suica Systems Department at JR East is quoted saying that the registration process has been "difficult" for many prospective users. Sounds like a common problem for "traditional" business moving into the mobile space: a generation accustomed to instant messaging and interactivity colliding with a multi-page application forms and postal services.

Technorati Tags: contactless, mobile, retail, transit

[Read more…]

If you’ve got nothing to hide, and all that

Wednesday, 25 April 2007 by Dave Birch

[Dave Birch] It’s got to be the best data breach of the week. Who cares about a few million card numbers, especially when the evidence seems to be that few of them will used. I don’t really care if my credit card number gets stolen, as it’s someone else’s problem. As for debit cards, well I suppose it might cause more inconvenience but I’m more worried about my card being copied (sans chip) and used in a foreign ATM to withdraw cash. The breaches that make the news may not be such a big deal anyway. Suppose a few million debit card numbers get stolen, for example. According to a study by Dove Consulting (from this month’s Digital Transaction News), this would result in the issuers re-issuing all the cards. But only 8% of the cards reissued by notified banks may have been compromised and of those, perhaps only 5% see a fraudulent transaction. But there are plenty of other things I would much prefer not to be disclosed…

Technorati Tags: internet, privacy, security

[Read more…]

One to many

Monday, 23 April 2007 by Dave Birch

[Dave Birch] A digital identity may map to many online virtual identities (ie, you might use OpenID to log in to World of Warcraft and the government) and it is this mapping that is usually being considered when we talk about managing virtual identities. But a virtual identity may also be owned by several real identities. That is, a husband and wife might both have the password to a single OpenID log in, or both have the PIN to the same smart card. In fact, this arrangement will be common in the business world (ie, several executive officers of Consult Hyperion control the digital ID “Consult Hyperion”). This is a logical way to organise things. However, the acid test of new structures like this is: what happens when something goes wrong?

Technorati Tags: identity, management, MMORPGS, virtual worlds

[Read more…]

Back to biometrics

Monday, 23 April 2007 by Dave Birch

[Dave Birch] I was surprised that the first item on the BBC news yesterday was again about card fraud (which they insist on calling chip & PIN fraud when it is only the PIN that is compromised). The main part of the report was entirely about petrol stations — and even claimed, I think somewhat imaginatively — that motorists are starting to use cash instead of cards. I wonder if the extent of the reporting of the fraud, if not the fraud itself, will genuinely cause a backlash against card use for fuel? And if it does, will people really go back to cash or will they instead prefer to move to a biometric solution such as the PayByTouch system installed at the Stop ‘n Save gas and convenience stores in Colorado, some of the 2,000 U.S. retailers that use the technology. Of these, Piggly Wiggly has the best name, in my opinion.

Technorati Tags: ATM, banking, biometrics, credit cards, debit cards, fraud, security

[Read more…]

We don’t need no stinking NFC phones

Friday, 20 April 2007 by Dave Birch

[Dave Birch] Over on the Digital Money blog, one of the topics we’re obsessed with is the collision between mobile phones and contactless technologies in the form of Near Field Communication (NFC). But in the long run, the use of NFC phones to manage digital identities will probably be more important. I think this is pretty clear to see given the rolling standardisation of the mobile/NFC space and the shape that is taking. This isn’t just the standardisation of the NFC interface, but also the mobile environment around it such as the SIM, where the addition of NFC support and a high-speed USB connection to the phone will transform the use of handsets. As I’ve said before, though, the addition of the the NFC interface together with access to that interface through standard interfaces within the phone is genuinely revolutionary. It integrates the handset into its local environment, making the mobile phone a link or pivot between the local and the global. It therefore will have big role to play in the use of digital identity in the future. The current projections (these change all the time) are that 20% of mobile handsets worldwide will include Near Field Communication (NFC) technology by 2012, according to New York-based ABI Research and in the digital money world many players are already preparing for that market. Visa, to pick just one example, believes there is a great opportunity to migrate some of the purchases being made by consumers today to the mobile phone. A Visa survey showed 67% of American males between the age of 18 and 39 would be interested in buying an NFC-enabled phone, while 57% said they would be willing to pay more for an NFC phone than a regular model. If the phone is going to become the average person’s wallet, then surely it can function as passport, driving licence and home banking log in device as well.

Technorati Tags: ID cards, mobile, nfc, passport, PKI, security

[Read more…]

Attacking 2FA

Thursday, 19 April 2007 by Dave Birch

[Dave Birch] Within all of the coverage of Barclays decision to start issuing 2FA "token authentication" devices to online banking customers (eg, me) to combat phishing and fraud, there were a few people pointing out that this kind of 2FA isn’t a magic bullet, specifically because of "man in the middle" attacks. We’ve discussed this before in the context of token authentication, but the problem extends to many other kinds of 2FA (basically, any 2FA that doesn’t implement end-to-end encryption).

Technorati Tags: identity

[Read more…]

Optical connection

Thursday, 19 April 2007 by Dave Birch

[Dave Birch] The identity of stuff, as much as the identity of people, is part of the digital identity landscape. One of the important technology threads, then, is the connection between the real and virtual identities of stuff. We’ve tended to think about RFID as the principal path, which it is, but there’s life in the old optical barcode yet. Microsoft, for example, has been working on a 2D coloured barcode (using colours means you can store more data than in black and white) which is now going to appear on DVD and video game cases later this year, thanks to a licensing deal with the ISAN International Agency. The Geneva-based organization assigns International Standards Audiovisual Numbers (ISANs) to movies and other works, and keeps a database about each title. Once ISAN-IA starts issuing the barcodes, then the publishers will be able to link products to web sites through that database. ISAN-IA and Microsoft imagine a day when consumers could use digital cameras to “scan” barcodes on DVD cases, in advertisements and on billboards, then be transported to a web page to watch trailers or buy products. As it happens, I’ve had this software on my Mac for a couple of years. It’s called Delicious Library: it allows your Mac to read the barcodes on books and things (using any old Firewire camera) and then go off to the web and look them up. Look: I’ve just scanned the barcode on the book on my desk and this is what comes up…

Technorati Tags: identity, management

[Read more…]

Tomorrow's Transactions

Thought leadership from Consult Hyperion

Archives for April 2007

Extending debit

Identity and government identity

Card fraud in the UK

Japanese lessons

If you’ve got nothing to hide, and all that

One to many

Back to biometrics

We don’t need no stinking NFC phones

Attacking 2FA

Optical connection

Recent Posts

Recent Comments

Recent Mobile Money Practice blog posts