Tomorrow's Transactions

Thought leadership from Consult Hyperion

Archives for July 2009

I didn’t understand this story

by

[Dave Birch] Perhaps it’s an age-related disorder, but I’m finding it harder to understand news stories. For example, I happened across this a couple of days ago:

Visa recently made a change to the fees that it charges retailers-something called an interchange rate-and it means that retailers must pay them a lot more when a consumer uses a Visa contactless debit card. In other words, when a consumer walks into a Best Buy and buys a $300 Blu-ray disc player, the amount of money the retailer gets to keep will differ sharply based on which Visa card that consumer chooses to use. By increasing those charges, Visa is trying to make up for some of the money lost through the new law.

[From The Credit Card Reform Backlash – CBS News]

What? There’s a higher interchange rate for contactless cards and this results in a higher merchant service charge for contactless transactions?

Best Buy pushed back last week (July 16) when it issued a statement to retail technology publication StorefrontBacktalk that was the retailer’s equivalent of a shot across the bow at Visa. Best Buy said that it “is constantly looking at ways to reduce the cost of check lane tender. As part of this exercise, we are evaluating the continued acceptance of Visa-issued contactless payment cards in our stores in light of recent price increases.”

[From The Credit Card Reform Backlash – CBS News]

Does anyone know how much Best Buy pays for a Visa contactless debit transaction compared to, for example, a Visa or MasterCard credit card transaction for a customer purchasing a $300 Blu-ray player? I don’t understand this story, so I was wondering if one of our US correspondents could read between the lines for me. I don’t understand why chains like Best Buy and Home Depot, where the average ticket must be more than $25, are considered prime contactless territory — do people rush in to Best Buy shouting “quick I need a Dolby 5.1 surround sound speaker system!!” and waving their Visa card in front of them?

,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Bring it on

by

[Dave Birch] As has been mentioned once or twice, the world of social networking provides a specific and immediate kind of weapons range for testing new ideas about identity and privacy. Facebook, in particular, seems to developing an emergent properties space where all sorts of experiments are already under way with the identity concepts at their core already one step removed from the common sense” view of identity . There is one class of experiment that I find particularly fascinating, and these are about matching and comparing the “grown ups” perspective against the “kids” perspective. US examples are always more acute because they involve law suits, so let’s start there. Here’s a fabulous example.

a suit was filed in Mississippi that alleges a school official—more specifically a teacher acting in her capacity as a cheerleading coach—demanded that members of her squad hand over their Facebook login information. According to the suit, the teacher used it to access a student’s account, which included a heated discussion of some of the cheerleading squad’s internal politics. That information was then shared widely among school administrators, which resulted in the student receiving various sanctions.

[From Cheerleader sues school, coach after illicit Facebook log-in – Ars Technica]

This follows on from other recent stories about employers demanding log in passwords for social networks and so forth. If my employer wanted my LinkedIn password, I would regard it is transparent evidence of their insanity and a clear flag that our working relationship had collapsed. But if you’re a kid and it’s a teacher asking, I suppose you might feel under pressure to comply with something that’s obviously a breach of natural justice. Not surprising, in many ways, because it’s always difficult for social mores to adjust to new technologies — people used to be given instructions for answering the telephone — and this stuff is still really, really new. People don’t yet have sense of what is naturally right or wrong in the new environment.

So, people in authority behave inappropriately when faced with new technology. No big surprise. But what I found fascinating about this story — and the lesson it contains about emerging “norms” around identity in a digital age — was the reaction of some other kids faced with the same demand.

…several other students asked for their logins simply deleted their accounts using their cell phones, preventing this sort of intrusion; the schools apparently have a filter that blocks access to its Web interface from school computers.

[From Cheerleader sues school, coach after illicit Facebook log-in – Ars Technica]

In a way, I find this heartwarming. The kids aren’t stupid: they live in that world and they can distinguish their multiple virtual identities. Faced with a privacy violation that undermines a virtual identity, they slash and burn. And the school’s efforts to prevent them manipulating their virtual identities are fruitless.

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

United we fall

by

[Dave Birch] I think that the decision by United Airlines to make some smaller travel agents process ticket sales on their own merchant accounts (and therefore pay the merchant service charge, or MSC) is one of those developments that seems on the margins at the time but actually signals the start of the supertanker’s turn. United’s new policy, starting 20th July, is for one reason: cost.

United would say only that the move was prompted by rising card-acceptance costs. “Credit card processing costs are escalating at a high rate and represent several hundred million dollars of cost each year,”… All travel-agent ticket sales on cards in 2008 totaled $79 billion, according to ASTA estimates, with an average discount rate of 3%.

[From News]

Never mind the average 3% MSC, the figure I thought was really shocking in this report was that brick-and-mortar agents account for nearly half of all airline ticket sales. I haven’t been in a travel agency for years (except to buy prepaid payment cards), all my personal travel is bought via web sites and all our corporate purchases go through invoices, so I was genuinely surprised to read that….

At the same time, airlines depend on so-called traditional, or brick-and-mortar, agents for somewhere between 40% and 50% of their ticket sales, with online agencies accounting for another 20% to 25%,

[From News]

Wow. To me, that was a genuinely surprising statistic. Anyway, that led me to wonder if people buy airline tickets with debit card given the price incentive — many airlines make an explicit charge for credit cards, but no charge for debit cards — or if the benefits of a credit card in these circumstances are seen as being sufficient to outweigh any surcharge.

Personally, I never buy airline tickets using anything other than a credit card, even though many airlines surcharge and try to get you to use debit cards. That’s because if anything goes wrong — let’s say the airline goes bankrupt, for example — then if you paid with a credit card you’ll get your money back. I’m more than happy to pay for the peace of mind. My top tips for avoiding fraud: use a credit card for everything in all circumstances and never use your debit card for anything except ATM withdrawals.

,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

The balance on this card is…

by

[Dave Birch] Several people mailed me the same link to the story about some Visa cardholders being somewhat surprised to find an unusually large transaction on their accounts.

A technical snafu left some Visa prepaid cardholders stunned and horrified Monday to see a $23,148,855,308,184,500 charge on their statements.

[From Glitch hits Visa users with more than $23 quadrillion charge – CNN.com]

How can you charge more than the GDP of the entire world to a prepaid card without a red light going on somewhere in the system? Once again, the golden rule is proven. Someone will always make a mistake, so make sure your payment system fails safe. A simple bounds check ought to do it: if PAYMENT_AMOUNT is greater US_NATIONAL_DEBT then “refer authorisation to a human operator”, or something like that.

, ,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Hubs and spokes

by

[Dave Birch] The hubs that have emerged in the mobile communications world to clear and settle inter-operator roaming and recharge are starting to add functionality that asks interesting questions. If you look at someone like eServ Global, who have added airtime topup and remittances (the “HomeSend” service) on top of Belgacom’s ICS hubbing business, you can’t help but wonder what the impact of cross-border value transfer might be in the long run. Suppose for example that people in countries where the currency is unstable or prone to inflation because of government “quantitative easing” (eg, Zimbabwe and the UK) decide to use airtime as their preferred currency? Not only would government income be hit but government attempts “manage” the economy would be undermined. I’m not say whether that’s good or bad, just that the connection between mobile resources and financial resources is two-way: just as we could use mobile networks to carry financial data, we could use financial networks to carry to mobile data (in particular, mobile identification and authentication services).

,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Why isn’t prepaid as exciting as it should be?

by

[Dave Birch] In a meeting about some new prepaid products, I was thinking back to Prepaid 09 (which was very good, by the way) and remembering that I left feeling slightly flat. There was lots going on, sure, but somehow I couldn’t help feeling that prepaid hadn’t broken through the way that it should yet. I don’t want to launch into a detailed analysis — apart from anything else, I don’t know what the answer is — but it’s worth flagging up one or two areas where the industry could try a little harder over the coming year.

One serious barrier to reaching the mass market, I think, is pricing. Not only that it is high, but that it is opaque. It’s difficult for people to work out how much a prepaid card is actually going to cost them, and this is an important calculation because the results are amazingly variable.

The study reveals that expenditures for the same transactions can range from $10 per month to almost $100 per month depending on choice of product or provider. Results indicate that there is no one financial strategy – whether based on using a traditional checking account, a prepaid card or check cashing services – that is right for all people.

[From Payments News: How Much Do Prepaid Cardholders Spend Monthly on Fees? – June 01, 2009]

We somehow need to persuade the industry as a whole to introduce some transparency and perhaps even some standardisation here. When I went to get a prepaid card for my son, I was shocked when I got home and read the charges — needless to say, that card was never recharged. Now that O2 and NatWest are shaking up the sector in the UK, there might be some more new ideas coming, which can only be good.

Another factor might be form. Are cards just too boring? I wonder if we could add more sex appeal by driving new technology (in particular, though I know I will get into trouble for mentioning them again, stickers) to deliver more compelling prepaid products in specific, but large, niches — you know, the usual kind of thing, sports stadiums, events.

,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Window pain

by

[Dave Birch] In “Tough Guy”, the autobiography of mafia criminal Louis Ferrante — which is an excellent book, by the way, even for someone like me who doesn’t normally care for crime books — I came across a poetic description of card fraud in an early incarnation. Louis’ enterprising confederates in the New York mob had discovered that you didn’t need to be able to forge cards terribly well to enter the counterfeiting business, provided you have collaborators.

For years I made big wood with Sonny’s “dupes”, phony credit cards with real numbers. He sold them to me for a hundred bucks a piece. Sonny had salespeople in retail stores on the take, boosting charge card receipts… I’d visit a jeweller who was in on the scam and buy a Rolex. If the watch retailed for five grand, I’d tell him to hit the card for ten. I’d leave with the watch. He’d made money. Both of us happy.

What the wise guys, as I believe they are know, really wanted though, rather than Rolex watches and the like, was cash. Card fraud was also a means to that end.

If I knew a guy who sold stuff I didn’t want, like Paulie Flowers, I’d work out a cash split. I’d show up and tell him “hit my card for four grand, keep two and give me two when you get paid”. He’d tell the card company he’d delivered arrangements to a wedding, and send them a phony bill of sale, and that was that.

Things have changed since then. That kind of card fraud was a sort of cottage industry, almost quaint. Today the fraudsters have followed the banks and the rest of the business world and globalised. It’s no longer about getting a Rolex and a few thousand to spend, it’s about investment and return on investment. Moises Naim’s book “Illicit: How Smugglers, Traffickers and Copycats are Hijacking the Global Economy” talks about the new cross-border, enterprise-scale organised crime. Card fraud is part of this, and that’s a big problem. From being a minor branch of mafia robbery, it’s become easy money for funding drug dealing, trafficking and even terrorism. This is why, even though the business case for the transition to chip and PIN was marginal from the bank point of view, the government were keen to see it go ahead.

Today card fraud is a cost of doing business, a few basis points. In the UK, that’s more than six hundred million pounds, which isn’t that much compared with total card spending, so it’s not surprising that it may not be the banks absolute no.1 priority at a time when chargeoffs are running at a hundred times the rate of chargebacks. I’m not bad mouthing the UK card industry: card fraud is a global problem.

Australian Payments Clearing Association data for last year shows fraud remains a fraction of overall payments: 44.5 cents in every $1000 of transactions in the case of credit and charge card fraud, 7.1 cents in every $1000 for debit cards and less than one cent in every $1000 for cheques. However, while cheque and debit card fraud are falling, credit and charge card fraud are rising – up from 36.9 cents the previous year. About 70 per cent of that increase relates to cardholders making purchases overseas via the internet and telephone.

[From Card crime jumps, so don’t get caught – Banking – Money – Business – Home]

A few basis points of turnover is a tiny fraction of the money spent on cards, but a big income for organised crime. So even though the crime is tolerated by the payment industry, it shouldn’t be. As Scott Loftesness said on Twitter when we were discussing this, we need to remember the “broken window” theory of policing. Tolerating crime that we can tolerate because it doesn’t stop us from doing business is a bad policy.

, , , ,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Doctoring the evidence

by

[Dave Birch] Health care is a very difficult environment to deal with, and no-one can underestimate the complexity and tensions in the space. I want my health details to remain absolutely private, but if I get run over by a bus then I want the doctor in casualty to have access to everything, instantly. There are basically two ways of doing this: storing my medical details with my doctor and letting other doctors access them, or taking my details and putting them in a big database for other doctors to access. In the UK, the government has naturally opted for the big database model. But as with big database models for everything else (eg, the Children’s Index) that means that privacy is hard to preserve because things will always go wrong.

Dr Paul Golik, secretary of North Staffordshire LMC and a GP in Norton-in-the-Moors, Stoke on Trent… accessed the personal details of a number of other patients registered elsewhere, including, with their consent, staff at his practice – all without being detected… ‘It’s basically open – we might as well put our names and addresses on Google,’

[From Pulse – GPs’ fears over new IT security loophole]

This is apparently the Conservative Party’s plan anyway.

Health records could be transferred to Google or Microsoft under a Tory government.

[From Google or Microsoft could hold NHS patient records say Tories – Times Online]

Why do health records have to be transferred anywhere? Everyone has to be registered with a GP, so let the GPs choose whichever service providers they want to store the data provided they comply with certain interface requirements. Then when I go to GP B while on holiday, he can put his smart card in his laptop and look up my health details at GP A (it would be easy to do: just make nhsnumber@gpa.nhs.co.uk autorespond with my health record in XML encyrpted using the public key of the requesting doctor). Of course, there might still be ways for it to go wrong, provided people are involved somewhere. Even the Germans are having problems securing national health data, although in their cases they’ve buggered it up in a “fail safe” way and lost the keys so that no-one can read the data, rather the having everyone read the data which I suppose if you’re going to make an error is the better way to do it.

Test runs with Germany’s first-generation electronic health cards and doctors’ “health professional cards” have suffered a serious setback. After the failure of a hardware security module (HSM) holding the private keys for the root Certificate Authority (root CA) for the first-generation cards, it emerged that the data had not been backed up.

[From Loss of data has serious consequences for German electronic health card – News – The H Security: News and features]

Oops.

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Isn’t this stuff serious?

by

[Dave Birch] OK, so I’m in a tiny minority but I think that security and privacy are important. I think that the state of security and privacy in the digital world demand a proper strategy, of which some form of digital identity infrastructure is a critical part. That’s why I’m always glad to see the government appointing people to tackle the difficult issues around the technology infrastructure that our future depends on. When I was googling something else, I discovered that Paul Murphy is Britain’s “Minister for Digital Inclusion”. This is a real post, not something I made up for the blog. In addition to pottering about at UK online centres (of which there are 6,000 in the U.K.!) his brief includes “data security and information assurance”. Imagine my surprise, then, when I read that:

Paul Murphy states that he is “not a technical person”.

[From Minister for Digital Inclusion gets Strategic – Convergence Conversation]

Shouldn’t we get someone who is?

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Petrol and paranoia

by

[Dave Birch] I stopped at the Reading services on the M4 to get some petrol and a coffee. I went into the shop and presented my excellent Barclays MasterCard with cashback and PayPass. The Eastern European woman at the counter told me that the chip and PIN machine didn’t work, promptly took my card and ran it through a stripe reader, then presented me with a slip for signature. I duly signed and wandered off. Once I got in my car and drove off, I started to wonder about this incident. Because I’m not normal (normal people don’t care about payments), the paranoia set in… Now I naturally assume that I have been the victim of a clever card fraud scam: the fraudsters recognised my card and they know that those cards have ICVV, so the details from the chip cannot be used to create a counterfeit magnetic stripe card, so they read the stripe details directly. Even now, I imagine a copy of my card is being used in a Tiranan jewellers. Had this not been late at night, and had I been more alert, I would have gone to the ATM and drawn out cash to pay for the petrol.

Shouldn’t a modern payment system free me from these paranoid concerns?

,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

RSS Recent Posts

RSS Recent Comments

RSS Recent Mobile Money Practice blog posts