Tomorrow's Transactions

Thought leadership from Consult Hyperion

Archives for August 2010

Gates

by

[Dave Birch] I’m happy when my teenage son is on Facebook talking to all of his friends from the warmth and comfort of his bedroom rather than hanging out with them in a freezing and desolate town centre where he might get stabbed (I’m probably worrying too much, since only a couple of dozen teenagers have been murdered in London so far this year). A crucial difference between online communities and “real” communities is, frankly, safety and security. You can choose which online communities that you belong to an you exclude, block or unfriend people you don’t like. In comparison, the real world (for many people ) is simply awful: there’s nothing you can do about the neighbours who play loud music all night, the teenagers who smash up the bus shelter every week and the drunken yobs fighting in the city centre on Friday night (I’m using specifically English examples here of course). As I said before

he real world is a horrible place, especially near where I live. No wonder that I prefer to sojourn in cyberspace. Is this because I am a geek, an outlier? No, it’s because I’m normal.

[From Digital Identity: Why virtual identities are real to some of us]

But the ability to build virtual walled communities that have digital gates that are far more effective than the ones on physical walled communities isn’t the whole story. There’s something else going on. The interaction between virtual identities is for some people better than the interaction between physical identities.

Participants in 3D virtual worlds are more satisfied with the romantic relationships they form online than with their real-life relationships, and their levels of sexual satisfaction are similar across both worlds, according to two studies conducted by researchers at Loyola Marymount University.

[From The business of virtual sex – Hypergrid Business]

This is, on the one hand, another argument for security and for using cryptography to construct and manage virtual identities (something I am wholly in favour of) but also, on the other hand, another recognition of the reality of virtual reality.

In order to become more attractive to business and educators, virtual worlds need to incorporate more gaming elements, not fewer, into their platforms — those elements, like achievement systems and ratings, that make the platforms more engaging and immersive.

[From Why virtual worlds suck for business — and some solutions – Hypergrid Business]

This is about forming a reputation-based economy from the bottom up, where peoples’ sense of their own personal identity is formed online and not assigned or inherited offline.

, ,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Another BRIC in the wall

by

[Dave Birch] So far as the commonly-discussed "next billion" consumers are concerned, the idea of some kind of universal payment card is vanishing. We've spent the last 50 years trying to make Visa, MasterCard, Amex and others into globally-accepted brands and I, like many other consumers, get off the plane anywhere on Earth and expect my UK-issued Visa debit, MasterCard credit and Amex credit cards to work without let or hinderance (except in the US, of course). But will this be true for the rest of the world? Isn't there a "balkanization" of payments underway?

The examples to study are, it goes without saying, Brazil, Russia, China and India. China, with China Unionpay, already has its own payment card (if you live in China, you cannot get a MasterCard, a Visa card or an Amex card), but that does at least share technical interfaces with the rest of the world. However, China's newest venture in payments does not.

China Mobile has confirmed that it plans to continue to "vigorously promote" its 2.4GHz RF SIM technology both in Shanghai and in other Chinese cities.

[From China Mobile will continue to ‘vigorously promote’ RF SIM • NFC World]

The 2.4GHz technology referred to here is a longer-range RFID standard (I think it's the same as in the Hitachi Mu-chip) that is entirely unrelated to the short-range NFC standard being adopted everywhere else for payments, including in China by rival China Unicom.

The new service will enable China Unicom subscribers to store a prepaid card account on their mobile phones. They will then be able to top up the prepaid account by transferring funds over-the-air from their Bank of Communications bank account.

[From China Unicom and Bank of Communications announce commercial NFC payments launch • NFC World]

Bit of a niche, really. They've only got a few hundred million subscribers. Anyway, the Chinese model of having a national payment scheme is admired elsewhere.

To promote the use of plastic money, the Reserve Bank of India is set to launch an IndiaPay card modelled on the China UnionPay card.

[From The Telegraph – Calcutta (Kolkata) | Business | China model to promote plastic]

Given India's desire to develop more financial services for the its population, financial services that will have to be configured to meet the specific needs of their population, you can see the desire to integrate a national payment scheme more closely with a number of other specifically Indian initiatives, such as the Universal ID (UID) scheme.

The Bank of Maharashtra (BoM) on Thursday announced its plans to launch a number of new biometric ATMs, which will enable elderly citizens to use the facility without having to commit their PINs to memory.

[From Forget the PIN: banking now at tip of senior citizens’ fingers]

These aren't the only examples. As I understand it, Russia is considering a law to insist on domestic transaction processing and perhaps a government-subsidised "RussiaPay" and there are plenty of other countries where the international card schemes have been caught up in an anti-globalisation backlash.

Bradesco and Banco do Brasil have announced signing a Memorandum of Understanding "regarding the launch of a Brazilian brand and integration of part of their credit cards operations." Specifically, they have entered into a non-binding memorandum of understanding for the preparation of a business model, involving:

* The integration of part of their card operations;
* The launch of a Brazilian brand ("Elo") of credit, debit and pre-paid cards for account-holders and non-account-holders;

[From Bradesco, Banco do Brasil Agree to Launch New Brazilian Card Brand]

Some banks in Brazil already have their own EMV debit schemes that are not linked to international brands, so you can see why it would make sense to bring them together into a national scheme. They might then, perhaps, issue a Visa/MC/Amex application on to the same cards for international travellers: the ability to load multiple payment applications to the same card is an under-utilised capability of EMV, although there are a few banks around the world already issuing such cards (POSB in Singapore being the latest).

Does this mean we are moving away from universal schemes? It seems to me that we are already losing them. When I was in SF last week, I did my usual round of experiments so that I could see for myself what the situation is. I found a very mixed bag. For example: none of my UK-issued contactless cards worked in the contactless terminals in SF although my UK-issued contactless sticker did (it's obvious why: although the sticker is issued in the UK it implements MSD as do the US terminals, and the US terminals don't implement EMV). As an aside, there were several places where my UK cards were refused in unattended environments: BART machines, CalTrain machines (once with an interesting "bank not on file" error message), SFO cart machines. I wonder if the UK issuers are declining unattended transactions when tney are not chip and PIN? If so, it's an odd decision, because in many retailers I was never asked for a signature for transactions under $25 and for transactions over $25 when I was asked for a signature I signed as "Carlos Tevez". In a couple of retailers I was asked to provide picture ID, so I produced my English driving licence, which none of the retailers could possibly have verified, and everyone was happy. In one retailer, my son was using the prepaid card I had given him for his holiday and the retailer asked him for picture ID (which he didn't have with him) so I just told the clerk "this is a prepaid card so he doesn't need picture ID" and the clerk said OK and ran the card anyway. In a restaurant one UK prepaid card was declined but the other was accepted: I've no idea why. A decade ago, I knew I could go pretty much anywhere in the world with my Barclaycard and it would work. A decade from now…

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Depends what you mean by…

by

[Dave Birch] Over at the GSMA's Mobile Money Exchange they've created a wiki for mobile money in an attempt to facilitate communication by pulling together a common set of definitions for the space, which is a laudable goal. If you're interested in the topic, it's definitely worth popping in and adding to the sum total of human knowledge. I'm sure that won't mind a little vigorous debate either! If their efforts go any way to stopping people from talking about mobile banking when they mean mobile money transfer or mobile money transfer when they mean mobile payments, it will be a job well done.

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Listening in

by

[Dave Birch] Who should we be listening to when formulating digital identity strategy? Consumers? Experts? Politicians? Lobbyists? Consultants? Consider, for example, the issue of privacy. This is complicated, sensitive, emotive. And some of the voices commenting on it are loud. Take a look at the “Wal-Mart story” — the story that Wal-Mart are going to add RFID tags to some of their clothing lines — that has naturally attracted plenty of attention. One particular sets of concerns were founded on the idea that consumers could not have the tags “killed” and so would be tracked and traced by… well, marketeers, advertisers, sinister footsoliders of the New World Order, the CIA and so on. So what is the truth?

The tags are based on the EPC Gen 2 standard, which requires that they have a kill command that would permanently disable them. So the tags can, in fact, be disabled. Wal-Mart does not plan to kill the tags at the point of sale (POS), only because it is not using RFID readers at the point of sale.

[From Privacy Nonsense Sweeps the Internet]

As a consumer, I don’t want the tags to be turned off, because that means that the benefits of the tags are limited to Wal-Mart and not shared with me. I’d really like a washing machine that could read the tags and tell me if I have the wrong wash cycle. And there are plenty of other business models around tags that might be highly desirable to consumers.

If it adds £20 to the price of a Rolex to implement this infrastructure, so what? The kind of people who pay £5,000 for a Rolex wouldn’t hesitate to pay £5,020 for a Rolex that can prove that it is real. Imagine the horror of being the host of a dinner party when one of the guests glances at their phone and says “you know those jeans aren’t real Gucci, don’t you?”. Wouldn’t you pay £20 for the satisfaction of knowing that your snooping guest’s Bluetooth pen is steadfastly attesting to all concerned that your Marlboro, Paracetamol and Police sunglasses are all real.

[From Digital Identity: The Rolex premium]

So does the existence of convenience, business model, consumer interest and practicality mean I have no privacy concerns? Of course not! So what is a reasonable way forward?

Wal-Mart is demanding that suppliers add the tags to removable labels or packaging instead of embedding them in clothes, to minimize fears that they could be used to track people’s movements. It also is posting signs informing customers about the tags.

[From Wal-Mart to Put Radio Tags on Clothes – WSJ.com]

That seems like a reasonable compromise: make it easy for people to cut the tags off if they don’t want them. So is that the end of the story? I don’t think it is.

What could possibly violate our privacy with tracking pants in a store to make sure there aren’t too many extra-large sizes on the shelves?

[From Privacy wingnuts « BuzzMachine]

The thing is, I agree with Jeff Jarvis here that some people are, indeed, “wingnuts”. But that does not mean that there are no genuine concerns and it does not mean that anyone who is concerned about privacy (eg, me) is a wingnut. But what it does mean, I think, is that we need to implement new identity technologies in a privacy-enhancing fashion and make the “privacy settlement” with the public more explicit so that there is an opportunity for informed comment to shape it. It seems to me that some fairly simple design decisions can achieve both of these goals, something that I’ve referred to before when using Touch2id as an example.

, , ,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

There has to be a reason for this

by

[Dave Birch] The German personal identity card is being introduced with an online framework. The eCard-API framework — which is essentially collection of standards for services including e-passport, e-health and so on — means that e-commerce, e-banking and e-government will be able to use the card to provide secure services to the public (although note that these third-party service providers will not have access to the on-card biometrics). The cards have a contactless interface: to use them online, customers will have to buy a USB contactless reader to plug in to their PC and then download the free “Burgerclient” software. Service providers who want to access data on the card have to mutually-authenticate, which means that they must present the card with a valid permission certificate (they get these from accredited certificate service providers, known as “Trust Centres”). If service providers want the use the card in a transaction, the customer must first confirm what data is beign read from the card then authenticate with a six digit passcode, thus providing convenient 2FA for online services.

SCM’s RFID-based contactless card readers form the core of Secure IT Kits that the German government will make available without charge to citizens, through its suppliers, to encourage the use of the electronic ID cards.

[From Global IDentification: SCM Microsystems to supply German eID readers]

For Martha’s sake! Germans not only get a useful ID card but they get free card readers for their PCs as well. Now that’s what I call a networked nation. Germany has over 70% Internet penetration and, according to BITKOM (the German Federal Assocation for Information Technology, Telecommunications and New Media), five months before the official launch of card more than half of them had already stated that they wanted to use the card for home banking and access to public services. The Brundesdruckerei (Federal Printing Office) has already put forward a plan to allow citizens to load their electronic identities on to NFC-capable mobile phones in the future.

I particularly like the way in which the cards generate per-service provider pseudonyms, so that everytime the customer logs in to, say, Amazon, they would have the same “ID number”, but the bank would see a different number and so would the tax authority or another store or anyone else. This basic partitioning was precisely the kind of intelligent design decision that I would have advised the UK Home Office to adopt, had they asked me.

Germany’s new contactless National Identity Card… sounds rather like what the UK ID card was meant to do, but the policy and politics surrounding it were so poorly conceived and communicated that the concept was never likely to be a success.

[From Electronic ID cards are rubbish? Don’t tell the Germans – Computer Weekly Editor’s Blog]

No! It was not an issue of policy and communication. The UK card was rubbish: it was just a different-shaped passport. You couldn’t use it for e-business or e-commerce or, for that matter, business or commerce. The German card has been designed by identity experts and engineers, not by politicians and management consultants. We Brits didn’t get an API or even a published interface.

, , , ,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Prepaid preconceptions

by

[Dave Birch] I've been involved in a few discussions about prepaid cards over the last couple of weeks. One of those discussions was about whether some prepaid products would remain viable under stricter regulatory conditions. Why would regulators want to increase the regulatory burden, and therefore cost, of products aimed at the unbanked? Well, in the US, prepaid cards are the focus on attention because of their supposed criminal use.

The "Stored Value Device Registration and Reporting Act of 2010" will close a loophole that has treated stored value cards differently than cash, money orders and traveler's checks..

  • Money stored in electronic devices would be considered the same as currency for regulatory purposes. Prepaid cards, cell phone chips and other electronic devices would be covered.
  • Stored value devices loaded with more than $10,000 would have to be registered with the Treasury Department.
  • The flow of money via stored value devices would be tracked. "There's no current data on how stored value devices are currently used" to smuggle funds, said Giffords.

[From Bills aims to snip cash-card money smuggling | Border]

Well, I'm sure there's lots of data on how stored-value is used, but it is of course private and the issuing banks would of course need a warrant to give it up. But I'm still curious to know whether criminal masterminds really are using prepaid cards instead of cash. My O2 Money card, for example, has a maximum balance of five hundred pounds unless you go through KYC/AML in which case it goes up to ten grand. So what criminal mastermind would want twenty O2 Money cards rather than a hundred $100 bills or twenty €500 notes? The article specifically mentions drug cartels, but when the police bust the Mr. Bigs, they don't find prepaid cards, they find cash.

"Don't trivialize this by calling these gift cards," Goddard said. "These devices can hold hundreds of thousands, if not millions of dollars."

[From Bills aims to snip cash-card money smuggling | Border]

No, they can't. The maximum you can put on a typical US prepaid card with going through KYC is $500-$1,000. But a drug-running master criminal might decide to get a hundred card and put $1,000 on each of them I suppose. Let's take a look at what we find in their treasure hoards.

The arrest of more than 2,200 persons and seizure of 74 tons of illicit drugs in 18 states in a massive nationwide undercover investigation by federal, state and local authorities has revealed that Mexican drug smuggling organizations are well entrenched in the United States… the operation accounted for $154 million in cash, 1,262 pounds of methamphetamine, 2.5 tons of cocaine, 1,410 pounds of heroin, 69 tons of marijuana, 501 weapons and 527 vehicles.

[From Massive bust nets suspects, drugs in 18 states – Washington Times]

But not, apparently, prepaid cards. Similarly, these ice men clearly prefer greenbacks to Starbucks' cards.

Authorities confiscated more than $200 million in U.S. currency from methamphetamine producers in one of this city's ritziest neighborhoods, they said Friday, calling it the largest drug cash seizure in history… Mexican officials said the cash seized was mostly in U.S. $100 bills and weighed at least 4,500 pounds.

[From Mexico meth raid yields $205 million in U.S. cash – latimes.com]

That's TWO TONS OF CASH. I suggest that the Senate turns its attention to the abolition of the $100 bill rather than imposing cost and inconvenience on my kids US$ "Cash Passport" cards that they have with them on vacation in California. Some more people who don't read my blog about the benefits of electronic payments over cash were uncovered last year.

Federal agents have rounded up more than 750 suspects in a wide-ranging crackdown on Mexican drug cartels operating inside the United States… The DEA seized more than 23 tons of marijuana, cocaine, heroin and methamphetamines; plus dozens of planes, boats and cars; more than $63 million in cash; and scores of weapons in the operation.

[From Feds Bust 750 In Mexico Cartel Crackdown – CBS News]

No mention again of their Sears gift cards or Walmoney. And, as an aside, the guy who owned the house that had the $200m in cash in it? He actually had $340m, most of which he spent in Las Vegas apparently, where the casinos assumed that he was legitimate businessman — his mistress paid a million dollars in cash for an apartment, shouldn't that ring some alarm bells? — unlike those Canadian casinos where the real criminals go to launder money.

Money laundering by organized crime groups is rampant at Canadian casinos but police are essentially doing nothing to combat it… "Since 2003, FINTRAC (the Financial Transactions and Reports Analysis Centre of Canada) has sent several disclosure reports to the RCMP on suspicious transactions involving casinos throughout Canada, with amounts totalling over $40 million," the 2009 report states.

[From Money laundering thrives at casinos: Report]

Come on. Prepaid cards don't make the slightest difference to criminals, tax evaders, drug smugglers or executive expense chats. But making them more expensive and more inconvenient does make a difference to people who are excluded from the financial system.

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Fluttering

by

[Dave Birch] I happened to be at a seminar about online payments for gaming and gambling and sat in on a fascinating talk by Jim Noakes, the Head of Payments at Gala Coral Remote Gambling, on the challenges that he is facing at the moment. It was fascinating because his list of challenges could easily serve at the basis of a requirement specification for a next-generation payment system. Setting aside the challenges of compliance, I thought there were two key challenges that we (ie, the payment industry) might be able to help with. The first is reducing the cost of cash in, and the second is reducing the cost of cash out (ie, winnings). The latter is often where the fraudsters attack, particularly when they get payouts directed to stolen cards. And because the online gambling companies are specific targets for the fraudsters, any solutions must have a high level of security built-in from the very beginning.

The kind of fraud they are subject to is that a criminal will spent several thousand pounds on a bent card and get back half in winnings, which are then paid out as “clean” money — exactly the same way that criminals launder money through physical casinos — and off they go. Sometimes the game operator may suspect that there is a scam underway, but there’s not much they can do to stop it. I suppose they could hold all winnings for 181 days until all of the chargebacks have been through but I don’t suppose that would be a popular approach! As an aside, let’s just remember that not all criminals target online gambling though!

State gaming officials said the theft of money from a high-stakes slots machine at The Meadows Racetrack and Casino went unnoticed for several weeks because the false jackpots that the machine was paying out to a trio of suspects were not recorded internally by the machine. State Gaming Control Board spokesman Doug Harbach said that detecting the theft of more than $430,000 would have been easier if the winnings displayed on the machine matched its internal records.

[From Gaming security failed to record slots theft]

A couple of other points of note: first of all, Jim said that customers like 3DS once they get used to it, and after a while they will actually call up when it is missing (because the directory server has failed or whatever) and said that, and I do quote, “there is a business case for 3DS any day of the week”. He also mentioned that they don’t store card numbers (PCI-DSS and all that), but actually it would be useful to because then they could spot card use across multiple accounts, and this would help to fight fraud. I wonder if there are other examples where attempts to crack down on card fraud in one area lead to more fraud in other areas?

Incidentally, with reference to the recent fuss about the exclusive use of Visa at the Olympics, Jim said that Gala Coral wouldn’t take MasterCard for a while — I’m not sure why — but that it “didn’t matter as most customers to seem to have Visa and MasterCard”.

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Passport minus

by

[Dave Birch] Pretty much every decision that the British government has made about ID cards has not only turned out to wrong, but almost optimally wrong. The collection of civil servants, management consultants, ministers and special advisors managed to leave us in as bad a situation as when they started — with no national identity management infrastructure — but hundreds of millions out of pocket. There is now a manifesto to get everyone online by 2012, but when they get there they won’t be able to do anything since there’s mechanism to identity or authenticate anyone other than usernames and password, which of course mean a massive increase in identity fraud.

The current coalition are just as bad: they have no strategic vision for identity, no tactics for getting us there and (crucially) no more understanding of the technology than their New Labour predecessors (who, to be fair, didn’t understand the problem either). As Ben Laurie of Google, someone whose opinion I always take seriously, puts it

The trouble with allowing policy makers, CEOs and journalists define technical solutions is that their ability to do so is constrained by their limited understanding of the available technologies.

[From Links]

Quite. And in the field of identity, where “common sense” is an appallingly bad basis for requirements capture, they have even less chance of randomly happening across a workable solution than they do in the fields (pun of intended) of rural payments, where a cool ONE BILLION POUNDS has been totally wasted. The coalition’s decision to simply scrap the ID card scheme was stupid.

Neither the existing scheme nor the Coalition scheme (ie, nothing) actually solve any of the problems that the lack of an identity infrastructure creates and I absolutely predict that the lack of such an infrastructure will in turn create a major barrier to improving efficiency in public services

[From Digital Identity: Back to the future of the ID card]

One of my pre-election suggestions to a couple of relevant “think” tanks was that the ID card should be renamed the Passport Plus, and sold as a revenue-raising £50 optional extra to passport holders: this would be straightforward to implement, since the ID card has no function other than as a travel document in the EU anyway. The wisdom of this suggestion has just come back to bite me.

,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

By “cash”, we mean “cash and not cash”

by

[Dave Birch] A correspondent writes to point me to the new report from Federal Reserve Bank of Boston called “Who Gains and Who Loses from Credit Card Payments? Theory and Calibrations“, hoping to infuriate me by quoting from the abstract, which says

On average, each cash-­‐‑using household pays $151 to card-­‐‑using households and each card-­‐‑using household receives $1,482 from cash users every year. Because credit card spending and rewards are positively correlated with household income, the payment instrument transfer also induces a regressive transfer from low-­‐‑income to high-­‐‑income households in general.

So people who use cash subsidise people who use cards? Well, yes, if you take the same definition as this report does…

For simplicity, we refer to consumers who do not pay by credit card as cash payers, where “cash” represents all payment instruments other than credit cards: cash, checks, debit and prepaid cards, etc

Ah… now I understand. So what the report is saying is that without price discrimination at point of sale, people who don’t use credit cards subsidise people who do (this is correct) and that because the people who use credit cards tend to be richer, so the poor are subsidising the rich because of the payment systems in place in the US (also correct). Yet another argument for abolishing cash, if you ask me, since cash is the payment method that imposes the highest transaction costs on the poor.

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

My new mantra

by

[Dave Birch] Why do people (eg, me) say that “identity is the new money“? What does the catchphrase actually mean? I use it because I can see that we are heading into a transition period between the “old” world of electronic payments where we built dedicated networks to move money from account to account (the world of Visa and American Express, MasterCard and Diners) to a “new” world of electronic payments where there is a single network that all participants access. The money stays put in the cloud while we move our identity around access channels (the world of PayPal and M-PESA, WebMoney and QQ Coins).

The dynamics are easy to understand. The downward pressure on the pricing of commodity payments, the ubiquity of intelligent devices (of which the mobile is currently the most important) and the ease of connecting banks, retailers, processors and others, combine to create a new landscape, where most of the value of the payments layer comes from the ability to identify and authenticate the participants in the transaction.

We have long observed, in our classification, that in the long run digital identity will be more valuable than digital money. This is because authentication is difficult and expensive: if you break down the way that, say, your debit card works, and separate the authentication part (the chip and PIN) from the processing and settlement of the transaction (and all of the fraud management, customer support and so on) you can see the asymmetry between the money part — a few bytes moving from bank to bank — and the identity part.

There is an interesting area for speculation identified by this analysis. Who will provide the identity functions? Will it be the existing players who bundle identity as part of the payments business — PayPal or Barclaycard — or will it be players who deal with identity and reputation — Experian or the Passport Services — or will it be the players who with authentication and switching — Vodafone or Google — or will it be an entirely new class of organisation?

I have a suspicion that it will be the latter. Just as new economic environments have led to new kinds of organisations before, so they will again. Just as Visa arose to exploit new opportunities, so something like Visa arise to create a digital identity infrastructure that creates new value. There is some logic to the proposition that it will be the mobile operators who in some way will give birth to this new organisation. That’s because the technology required to implement digital identity is founded on public key infrastructure (PKI) and for this to work we need some secure storage, some tamper-resistant hardware, to store our private keys and to execute authentication processes. Right now, the one piece of tamper-resistant hardware that everyone has is the SIM in their mobile phone. Indeed, there are a number of initiatives around the world that are already starting to use the SIM for precisely this purposes. The examples of Turkcell in Turkey and BankID in a number of Scandinavian markets have been looked at before. I’ve bored about this at length before:

One of the world’s leading experts in this field, David Birch, spent some time with me explaining how mobile operators, in particular, could actually become ‘smart pipes’ with financial transactions. The ‘secret sauce’ according to Birch, lies in the ability for operators to provide secure identification linked to the SIM providing private and public keys for multiple providers. The resultant digital signatures would allow for ultra-secure tow level authentication via the mobile device.

[From The ‘secret sauce’? – The Insider – TM Forum Online Community]

How might this play out? In the US, we already see ACH alternatives to scheme payments emerging. An example is the “Pinpoint” card marketed by First Data ISO American Payment Systems. It provides a per-retailer loyalty scheme combined with ACH payment. Imagine something like this combined with stronger 2FA authentication at POS — perhaps using 2FA to release an identity credential or authenticating using some mobile network-based validation (eg, ValidSoft’s “proximity” transactions validation) — to create a product where the payment is a commodity but identity isn’t.

, , , ,

[Read more…]

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

RSS Recent Posts

RSS Recent Comments

RSS Recent Mobile Money Practice blog posts