Archives for October 2009

For all you utter bankers

Thursday, 29 October 2009 by Dave Birch

[Dave Birch] Wow, that was excellent fun. Nothing really to do with electronic payments, but I’ve been playing a fantastic new card game called “Crunch: The Game for Utter Bankers” with the kids and some friends.

Crunch is a satirical card game for 2 to 4 players that places you at the head of the boardroom as a CEO of a global bank juggling the conflicting demands of your ailing bank and your future retirement fund. An average game sees you bribing your way out of government investigations, fending off aggressive takeovers and forcing debt onto the unsuspecting public. Meanwhile, reward your hard work by taking inappropriate bonuses and – when no one’s looking – brazenly embezzling your bank’s own funds and hiding them about your person.
[From Crunch – the game for utter bankers | BoardGameGeek | BoardGameGeek]

The game served a dual purpose, both of which left me delighted with it. First of all, it was fun to play. Basically, you build up your bank’s lending against assets (ranging from shares in listed companies to Nazi gold) and then when a crunch comes you trade in trust for government bailouts. It didn’t take long to learn, and both the kids and adults enjoyed it. It had an unexpected second purpose, though. I bought it for fun, but in playing it the kids asked a lot of questions about the credit crunch, about the relationship between assets and debt, and about the idea of deliberately growing your workforce and assets to become too big to fail (adding “workforce” cards also gains you “trust” cards).

Run, don’t walk, to your nearest games shop — I got mine from Playin’ Games in Museum Street opposite the British Museum — and pick up a copy of this super game.

Federal Trade Commission disclosure. I have no affiliation with Terrorbull Games, the creators of “Crunch”, and have received no payments nor any other form of remuneration related to this endorsement. No animals were harmed during the writing of this blog post.

banking and finance, prize

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

What a cunning stunt

Wednesday, 28 October 2009 by Dave Birch

[Dave Birch] I am, very literally, green with envy. I count myself as a reasonably good speaker, and I try to use narrative and historical examples to explain key principles. But nothing beats a good demo, and I saw an excellent one today, one that I wish I'd thought of!

At the Intellect conference on Identity & Information in London today, Edgar Whitely from the LSE gave a terrific presentation. He was pointing out that the principle of data minimisation in identity systems is important, but he did it in a particularly arresting way.

Here's what he did.

He showed this recent newspaper photograph of the British Home Secretary, Alan Johnson, showing off his new ID card and holding it up to the camera. This version comes from The Guardian….

Alan Johnson reveals the design of the British national identity card

Alan Johnson reveals the design of the British national identity card. Photograph: Stefan Rousseau/PA

As you can see in the picture, for reasons that will be not fully explained in a moment, the UK ID card has the holder's full name, date of birth and place of birth on it. These three data points are sufficient to uniquely identify the overwhelming majority of the population. So Edgar went to the Identity & Passport Service birth certificate ordering service and put in the details from the Home Secretary's card. He then paid his £10 and… with a suitably theatrical flourish, Edgar produced the copy of the Home Secretary's birth certificate that he had been sent in the post. Note that Edgar hadn't done anything wrong. As James Hall, the head of IPS who was on the same panel, pointed out, in the UK anyone can order a copy of anyone's birth certificate. He said that if you are a celebrity then hundreds of people will order copies of your birth certificate every year, which had never occurred to me. I'm sure James is right, but it does seem a little odd that people who want to commit identity theft will simply have to look at their mark's ID card to get started.

Edgar hadn't used the birth certificate to open a bank account or get a driving licence or anything, he was just making the point that if we don't adopt the right principles (eg, data minimisation) for identity systems, then we run the risk of making identity theft worse. It was a great presentation and a super stunt. Well done.

Anyone familiar with my deranged rantings about psychic ID (ie, virtually nobody) will be familiar with the general point: a characteristic of a 21st-century ID scheme is that it should only give up information necessary to enable a transactions, nothing more or less. So, if you are authorised to ask my ID card whether I am over 18 or not, that's all it should tell you. Not my name, not my address, not my age or date of birth. Just whether I am over 18 or not and that's it.

The current ID card scheme does not have this key characteristic, not for any functional reason but because the ID card and passport were jumbled up for a political purpose — the purpose being, as far as I know, to make it harder for an incoming administration to scrap the scheme — that constrains the design and implementation. Since the government wants the ID card to be used as a travel document within in the EU, it has to have certain human-readable information on it. That's why it gives away the key data points that make it tempting for criminals to kick-start their identity theft antics.

[Read more…]

The price of everything

Tuesday, 27 October 2009 by Dave Birch

[Dave Birch] I've just read a couple of pieces about pricing: the Chicago Fed's Letter 266a (September 2009) "Payments Pricing: Who Bears the Cost?" and the SPEED piece by the Deputy Governor of the Bank of Finland, Pentii Hakkarainen, "The future of retail banking: more competition needed". Pentii says that one challenge (to retail banks) is the "dependence of banks on cross-subsidisation, especially of payment services". I agree and I'm not sure that the magnitude of the cross-subsidy from efficient e-payment methods that (because of SEPA) are going to deliver less margin to the least efficient paper and metal methods is appreciated. So the regulators are pushing down the amount of money available for subsidy but will (of course) go beserk if any attempt is made to remove the subsidy.

One way in which they are reducing the amount available to subsidise cash is by pushing interchange fees down. Setting aside whether that's a good thing or a bad thing, it's certainly a thing. Earlier in the year, there was a Federal Reserve Board report "Interchange Fees and Payment Card Networks: Economics, Industry Developments and Policy Issues" that looked at the situation (in the US at least) in some detail. Amongst other observations, it noted that with respect to interchange fees:

In general, an efficient interchange fee is not solely dependent on the cost of producing a card-based transaction nor is it equal to zero.
An efficient interchange fee may yield prices for card services to each side of the market that are “unbalanced” in the sense that one side pays a higher price than the other.
The efficient interchange fee for a particular card network is difficult to determine empirically.

I think the last point is worth emphasising. There doesn't seem to be any reason to suspect that regulators should inherently know what the correct level of interchange should be. It follows, I think, that if the regulators believe that interchange is too high (for whatever reason) then the appropriate path to correction is increased competition.

costs and interchange, payment cards, retail

[Read more…]

Balancing security and privacy, part 97

Tuesday, 27 October 2009 by Dave Birch

[Dave Birch] I popped along to a City Forum round table on the Information Intensive Society. I was late, because of public transport, so I didn’t hear the chairman say that we were to stick to the Chatham House rule. As a consequence I started twittering what people were saying, as well as posting a picture! I apologise unreservedly — but the medium really is the message, isn’t it? Anyway, the subtitle for the meeting was “balancing security and privacy”, which I think framed the whole discussion the wrong way: the subtitle should have been “obtaining security and privacy”. I don’t want them balanced, I want them both: this is what, to me, marks the difference between these debates in the “old” context and the “new” context.

I think this is why I found the discussion unsatisfying — and I don’t mean this as a criticism of the event, or of the organisers, even though one of the speakers actually did say “the Internet is the future”. The problem is that there is a kind of assumption that privacy is an enemy of security and anyone who advocates more privacy is mutant commie scum (didn’t you used to play Paranoia?). If you put forward any alternative view, then it is answered with the old “well, if you knew what I knew blah blah” and the debate goes nowhere.

[Read more…]

Bear market

Thursday, 22 October 2009 by Dave Birch

[Dave Birch] Russia is looking like a pretty interesting market for e-payments. The management consultants keep telling us to focus on the BRIC (Brazil, Russia, India and China) for our next growth markets, but it’s important to understand that their mass, retail, e-payment markets are just not going to be like ours, partly because of industry structures, partly because of government direction and partly because of the technology starting point.

Russian central authorities are reportedly considering plans to set up an electronic payments network… The main objective of the prospective electronic payment system would be to challenge the dominance of established brands such as MasterCard and Visa, which currently hold around 85 percent of the Russian cards market. The plans for a Russian-operated electronic payment network come after in June 2008, Russia’s two largest banks – Sberbank and VTB Group – have teamed up to create the United Russian Payment System (URPS).
[From The Paypers. Insights in payments.]

What might the Russian “third scheme” look like, compared to a European “third scheme” (eg, PayFair)? Well, one reasonable prediction might be that the lack of infrastructure in Russia (Russia is a very big place) means that their third scheme might well jump ahead of the European third scheme in terms of its technology platform. Indeed, there are already strong indications that mobile and contactless technologies will be moving ahead quite quickly in that environment.

The head of Russia’s largest bank briefed the country’s President Dmitry Medvedev on the concept of mobile contactless payments last week — and explained that he is looking to launch a non-contact mobile payments system by 2011/12.
[From Russia looks to introduce mobile contactless in two to three years • Near Field Communications World]

A national contactless purse (perhaps a bit like NETS in Singapore or Touch n’Go in Malaysia) in a country the size of Russia would be a really interesting development. Singapore has shown that some judicious government steering can help to migrate to a contactless environment that is convenient for consumers who will…

…now have two payment cards to choose from to use on buses and trains, to pay for road tolls and carparks, and to make purchases from stores, eateries and entertainment outlets. On Friday, Nets (the Network For Electronic Transfers) launched its long-awaited multi-purpose contactless card… EZ-Link launched a similar contactless multi-purpose card in January.
[From Nets, more uses than one]

Transit is the vanguard, as always, but the point here is that competition to provide interoperable e-purses is at least a good step forwards.

cash and cashlessness, contactless and nfc, debit cards, emerging markets, transit

[Read more…]

Faster faster

Wednesday, 21 October 2009 by Dave Birch

[Dave Birch] At the Intellect Financial Services group meeting, Paul Smee, the Chief Executive from the Payments Council, gave an excellent summary of Council’s goals and objectives as well as making some suggestions for better co-operation between the technology industry and the financial sector, such as creating some kind of vendor forum. He said in passing that much of his focus over the last couple of years has been the Faster Payments Service (FPS). FPS is a little bit of a success story for the UK payments industry, so it’s worth talking about.

banking and finance, cash and cashlessness, cheques and checks, SEPA and PSD

[Read more…]

The DNS of the industrial bourgeoisie

Monday, 19 October 2009 by Dave Birch

[Dave Birch] I have a vague memory — which five minutes googling cannot substantiate and I'm too lazy to go and find the book in the other room — that somewhere in the Gulag Archipeligo by Aleksandr Isaevich Solzhenitsyn there is mention of Stalin's desire to have a more revolutionary telephone system where all calls had to go through a central exchange and be encrypted so that Stalin could listen to everyone else's calls but his would be encrypted to remain secret. The prisoners with relevant skills were supposed to be designing this while in the gulag. It never worked, of course, and the Soviet Union had appalling telecommunications infrastructure as a consequence because the communications revolution was halted by the dictatorship of the proletariat: there's some deep incompatibility between innovation and centralisation. I couldn't help thinking of this when I read about the calls by Eugene Kaspersky to have a more Stalinist internet:

The CEO of Russia's No. 1 anti-virus package has said that the internet's biggest security vulnerability is anonymity, calling for mandatory internet passports that would work much like driver licenses do in the offline world.
[From Security boss calls for end to net anonymity • The Register]

What he means by this is that he wants a technologically complicated and expensive solution to be implemented so that ordinary people are inconvenienced to the maximum while criminals can roam free (which is what would happen). Creating such an asymmetric solution is not the way forwards: for one thing, who would decide what to censor?

A little local controversy involving the Church of Scientology and its critics could lead to curbs on the right to anonymity of anyone using the web.
[From Scientology seeks to squash anonymity • The Register]

We already have experience of this "solution" in the UK. Laws giving a wide variety of bodies the ability to monitor CCTV, the internet, phone calls and everything else which were supposed to save us from international terrorism are used by local councils to stop people from trying to get their children into better schools and to check that people are recycling enough of their rubbish. I'm sorry, but creating a world in which anyone can read anyone else's e-mail, track anyone else's web browsing, see what anyone is reading is not the way stop Russian virus writers from taking over everyone's PCs. We need an identity infrastructure.

[Read more…]

The Swedish experiment

Thursday, 15 October 2009 by Dave Birch

[Dave Birch]Within the narrow confines of this blog, Sweden is one of the favourite geographies, partly because it is struggling with cash and partly because it is more transparent than some other banking systems.

The Swedish central bank published some detailed figures on the cost of payments and they provide useful input to the debate on the future of payments. They show that on average the variable cost of an ATM cash withdrawal to the issuing bank is around 1.3 SKr
[From Digital Money Forum: Cost dynamics, again]

Well, that doesn’t sound like very much. But in Sweden, it multiplies up to a big fraction of the economy because the Swedes are heavy ATM users.

Stefan Ingves (the Governor of said Central Bank) said that Sweden has “many more” cash transport robberies than its neighbours because, essentially, cash withdrawals from all ATMs are free (despite the large costs entailed in cash handling). This means, in turn, that Swedes use cash far more than Finns, Danes, Norwegians and (especially) Icelanders.
[From Digital Money Forum: The Cash Menace up North]

Mr. Ingves also notes (in the speech referred to above) that Sweden has far more cash-in-transit robberies than its neighbours and suggests an alignment of the private and social costs: the cost of armed robberies, he said, should be accounted in the cost of cash. This means that far from being free at ATMs, cash in Sweden should be expensive. He is, of course, completely correct.

costs and interchange, crime and fraud, notes and coins

[Read more…]

Another model that the UK could try

Tuesday, 13 October 2009 by Dave Birch

[Dave Birch] I’m going provide a case study on the use of multi-application smart cards with EMV “chip and PIN” software on them that I think contains some useful nuggets for us in the UK to ponder over, because the case study is about combining payment (EMV) and digital signature (PKI) applications on the same card.

Identity folks will have to understand a little about the payment folks’ EMV standard to understand the dynamics. There are actually three flavours of EMV, the international card scheme standard for chip transactions. These are Static Data Authentication (SDA), Dynamic Data Authentication (DDA) and Combined Data and Application Cryptogram (CDA). Most of the cards out on the streets in the UK are SDA cards without enciphered PIN (the PIN is not encrypted from the PIN pad into the card).

SDA cards are cheapest, which is why our banks issue them, but they can be cloned and used in terminals that are offline, so they are a security risk. DDA cards are not vulnerable in this way, but they are more expensive, both because the cards are more sophisticated — they have a cryptographic co-processor to handle asymmetric cryptography and take longer to “personalise” — but UK banks will have to replace SDA with DDA by end of 2010 (indeed, Consult Hyperion work with banks to help them to migrate in a cost-effective way). CDA cards cost the same as DDA, but still need to be planned for.

For technical reasons, CDA cards are more secure than DDA cards. Why? Because CDA protects against the “wedge attack”. It is possible to insert a device that would let a genuine DDA card generate a legitimate digital signature but then intercept the request for an application cryptogram and return a bogus one for a different amount to the terminal. The terminal would carry on regardless. This is not possible with CDA since both the DDA signature and cryptogram are delivered by the card at the same time.

OK, so all this is well-known, but why does it matter to the digital ID world? Well, if a bank goes to the expense of issuing DDA or CDA cards, then the presence of re-usable cryptographic software and the cryptographic co-processor mean that it is a minimum of cost and complexity for the card to carry an additional PKI application as well as the EMV application. Almost all of the PKI application’s “guts” are already on the card because they are used by the EMV application. What’s more, the card can generate its own key pairs (which is very good for security) and then, provided you have the infrastructure, third parties can sign the card’s public key(s) to create a wide variety of public key certificates to deliver interesting services. The card can store these certificates if it has enough memory or store pointers to the certificates online somewhere if it doesn’t.

Here’s a real example.

[Read more…]

What doesn’t add up

Monday, 12 October 2009 by Dave Birch

[Dave Birch] I’m still curious about US debit interchange rates, just as I was a couple of weeks ago when I misunderstood a magazne article on the topic. Remember that in the US, PIN debit (which grew out of regional ATM networks) costs less than signature debit, so you would expect merchants to incentivise the use of PIN debit or you would expect signature debit rates to fall towards PIN debit rates. In fact, since signature debit rates (via Visa and MasterCard) have remained fairly stable, what has happened is that PIN debit rates have moved up towards signature debit rates. Looking for some recent figures….

the average interchange cost for a small retailer on a $50 face-to-face purchase processed on a PIN-debit card with a major electronic funds transfer network logo in 1996 was 9.9 cents. By 2007, that same sale generated 40.1 cents in interchange… In contrast to PIN-debit pricing, signature-debit interchange has been stable since 2005… a small retailer in a $50 card-present sale with a Visa check card would pay interchange of 66.5 cents, and 67.5 cents on an equivalent MasterCard Debit transaction.
[From News]

Now, I reckon that the same retailer in the UK would pay 10p for a transaction that they pay 40 cents (30p) for in the US. So, I’m missing something here. Why does a debit transaction cost a merchant so much more in the US? For $50 transactions, setting the cost at 15 cents or 30 cents is not a make-or-break decision. But, obviously, for many merchants (especially in the cash-replacement potential market sector that I am interested in) the average sale is much smaller and a 40 cent charge on a $4 transaction eats up a lot of the merchant’s margin.

The chain’s average ticket is $6, a level at which it’s difficult to make money after deducting interchange, Jones argues. Currently, credit cards account for about half of sales.
[From News]

So unless I’m missing something else about the cost structure, the only interpretation of these figures is that merchants in the US simply pay a much higher fee than merchants in (for example) the UK do. Our friends at Payments News pointed me to a recent report that suggests that that is precisely the right interpretation.

U.S. swipe fees are: more than two times the rates in the UK and New Zealand, four times the rates in Australia, and over six times the cross border rates recently agreed upon by MasterCard and the EU
[From Merchants Publish A Look at Interchange Fees Outside the US]

Why is this gap so big? Surely the US market is just as competitive as the UK market? I read a recent analysis from Peter Jones of Payment Systems Europe — who put the average merchant fee at 1.8% in the US and 0.8% in Europe — and he attributed the difference to the competitive issuing market in the US, with card companies competing to attract consumers by offering ever-higher rewards and charging the merchants for them. You can see why merchants object to this: but what should they do? James van Dyke of Javelin has some sage advice.

Merchants have some valid concerns about the payments industry, but they should push back on their advocacy-group partners and lobbyists on the viability of this interchange campaign. The interchange debate is fundamentally an issue between differing camps of business entities, and to position it as a consumer-advocacy issue will ultimately be fruitless for the merchant community in my opinion.
[From Javelin Strategy and Research » The merchant cost-of-interchange debate: what are the facts?]

Yes, the cost of cards needs to come down. But the way to do this is by encouraging competition, not by whining to regulators.

cash and cashlessness, costs and interchange, retail

[Read more…]

Tomorrow's Transactions

Thought leadership from Consult Hyperion

Archives for October 2009

For all you utter bankers

What a cunning stunt

The price of everything

Balancing security and privacy, part 97

Bear market

Faster faster

The DNS of the industrial bourgeoisie

The Swedish experiment

Another model that the UK could try

What doesn’t add up

Recent Posts

Recent Comments

Recent Mobile Money Practice blog posts