Tomorrow's Transactions

Thought leadership from Consult Hyperion

Archives for May 2013

MNO-led or bank-led?

by

[Paul Makin] This is one of the most common areas of discussion in the world of mobile money: should financial regulators allow mobile money to be offered by new market entrants, typically mobile operators – or should they restrict it only to those established financial service operators, the banks? And then there are markets such as Nigeria, where anyone BUT a mobile operator can apply for a licence.

At Consult Hyperion, we do not have firm views on this question. Each operator type has its advantages and disadvantages:

Scheme Type

Advantages

Disadvantages

Mobile Operator-Led

Agility

Proven ability to develop and manage agent networks

Limited financial service discipline (processes, security, etc)

Tendency to pursue customer numbers at the expense of service quality or security

Bank-Led

Financial service discipline: adherence to process, attention to security, etc.

Poor understanding of mobile phone infrastructure and process, leading to security issues

Poor understanding of agent acquisition and management

Limited understanding of the mobile money market and the typical customer’s needs

Third-party-led

Agility

Potentially all of the above!

 

So, which is the best? Well, as the table suggests, ‘none of the above’ would appear to be the answer. Mobile operators are often refreshingly keen to deploy the new service as quickly as possible, and embrace the challenges with gusto, which can be a very effective approach when developing a new business. They also have a proven ability to develop networks of agents, and to manage them effectively once they’re in place, which is a key element of a successful mobile money service. But they often also have a culture that allows them to cut corners, particularly in following processes, which can lead to the undermining of elements of security.

In contrast, banks are naturally risk-averse, and will only launch a new service once it has been proven to be secure. This can be a strength, as it leads to a robust service, but it also has the potential to lead to a service that meets the bank’s needs, and not the customer’s. The unfamiliarity in dealing with networks of agents can lead to poor availability of agents and liquidity problems. And we are aware of a number of occasions when a bank’s lack of understanding of the normal operating procedures of mobile operators has resulted in apparently impossible (to the bank) frauds being perpetrated without any attack against the bank’s systems being necessary.

But conversely we would suggest that ANY of these can operate a mobile money network successfully, if they are prepared to take a dispassionate look at their weaknesses and address the issues that are uncovered.

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Digital currency for the general public

by

[Dave Birch] A digital currency is a currency that only exists in the virtual world of computers. It has no mundane rump like the Pound. Most Pounds — around 96% in fact — only exist in the virtual world of computers, but 4% also exist in pockets and purses and sofas through the land. If I decided that I didn’t like Pounds, and wanted to create a new currency of my own, it would be a bit of a hassle to have to start minting coins, printing notes and persuading Sainsbury’s to add another draw to their cash register. In the world of Apple, Angry Birds and Amazon though, this isn’t a problem. I can just make up my digital currency and off I go. Although, as the economist Hyman Minsky famously observed, creating money is easy. Getting it accepted is the hard part.

Why would someone take new currency, my Wessex e-Groats instead of Euros? Convenience, for one thing. Look at the private currencies, such as Marks & Spencer’s vouchers or Amazon Coins, as a pointer. A friend of mine paid at a farmer’s market in Surrey using a Marks & Spencer’s voucher and got change. They are money, at least in Surrey. And I spend a fortune on Amazon, so I’d have no problem in taking a tenner’s worth of Amazon coins instead of the tenner you owe me down the pub. Two decades ago, the lateral thinker Edward de Bono published a pamphlet called “The IBM Dollar”, building on the Hayekian platform of competition in currency as the way to obtain sound money and he has a point. But even he could not have imagined how the revolutionary capabilities of the internet and, in particular, the mobile phone make this not only possible, but inevitable.

It’s hard to imagine popping to the shops with half-a-dozen different kinds of banknotes in my back pocket, but not hard to imagine an app on my smartphone managing these for me and choosing the best currency for the purpose at hand. It isn’t all about convenience and efficiency though. Some currencies, and Bitcoin is a current example, a really more idealogical in nature. The people who champion Bitcoin are only partly concerned with transactions. They are more concerned with removing the governments hands from the monetary reins. You don’t trust the government to run supermarkets, they might say, so why let it run money? The same goes for many who advocate electronic gold or some kind of world currency based on commodity prices and the like.

Others think, and I’m one of them, that the future of digital currencies is more closely connected with the future of communities, both physical and online. In places where the current monetary arrangements have all but collapsed, such as Greece, we already see local groups developing their own currencies to replacing the misfiring euro and we see the first experiments here too, with the Brixton Pound and so on. The economy of London is already distinct from the rest of the United Kingdom, so that would be a good place to start. If London started its own digital currency and if Scotland started its own digital currency, then their utterly distinct economies could be freed from the mutual shackles of national monetary policy.

In so far as the government, rather than international bond markets, controls that monetary policy you can see the possibility for some form of oversight or governance. But in a world of hundreds, thousands of digital currencies it will be the market that sets the values. Right now, we use one currency, Sterling, for everything. But I suspect our children might regard this as outdated as the Edwardian gold standard we so fondly remember in the slang “half a dollar” moniker for the half-crown coin. They might use Bristol Pounds or World of Warcraft Gold when they go shopping, but put Kilowatt Cash and Motorway Moolah in their pension funds. It seems to me that as the currency iceberg slips under the waves of the cyber-sea, we’re going to see a new world of choice between currencies that embody different values, and that’s a good thing.

(You can listen to the interview based on this essay via the BBC iPlayer here, starting at 45 minutes in.)

These are personal opinions and should not be misunderstood as representing the opinions of�
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

The US surcharging mess

by

[Dave Birch] There’s an interesting article about the ongoing retailers vs. schemes litigation in the May 2013 issue of “ISO & Agent“. It’s by Autumn Cafiero Giusti and it’s called “Merchant-Surcharging Worries” and it observes that

Consumers who pay with cash, check, debit or prepaid cards would not be subject to the acceptance fees, which would apply only to credit cards.

This is ludicrous. If we are going to have surcharging, it should not be on the basis of which set of lobbyists won in Washington but on a rational basis that aligns with the national interest. Credit card issuers and retailers are not the only two groups of stakeholders in the retail payments world and the interests of wider stakeholders should be considered. There is no doubt in my mind where that line of thinking would take us.

Debit cards, and pre-paid cards, deliver the minimum social costs. Therefore, they should be the zero point… Every other payment mechanism (including cash) should then be charged for.

[From Which payments should be surcharged and, more importantly, why]

PIN debit is the best option for society as a whole, Instead of allowing surcharging for credit cards only, I’d regulate the other way round. Make it a legal requirement that any retail price displayed by any retailer for any good or service must include the cost of payment by PIN debit. Leave it to the retailers to accept or reject, charge or not charge for anything else. This is the rational option for the USA.

Why then do we have the apparently irrational proposition to surcharge credit cards only on the table? Well, these are very political times. In the whole of the schemes vs. retailers smackdown, I’ll bet that considerably more money went on politicians than on, say, economists. Or, for that matter, consumer groups.

The banking industry and the merchants coalition have each hired more than a hundred former government officials to lobby for their interests, according to Sunlight Foundation.

[From Banking Groups Stir Consumer Fears on Debit Card Regulations via Twitter – ProPublica]

I doubt that much attention was paid to technologists either. If the Senate had asked, for example, me about this then I would have told them to focus on making it easier for competitors to enter the payments market and let the hand-grenade of mobile shake things up.

The intersection of government policy and innovation could result in regulations being made by lawmakers who do not fully understand the emerging mobile payment industry.

[From Card Not Present.com CNP Expo: Danger of ‘Over-Reactive’ Legislation in Payments – May 22, 2013]

Wait, “could?”. I’d say it was racing certainty. I was at this panel (which was excellent, by the way) and asked a big picture question at the end. I asked what the point of payments regulation was. What was the US’ goal? Is it to minimise social costs or selected private costs? To balance security and safety with expense? To distribute costs in a fair way? What? The answer was, if I understood it properly, that no-one knew. Payments regulation in the US is, as one of the panelists rather amusingly said, two fat guys fighting over dessert. The fat guys are the banks and the retailers, the ones with the lobbyists, and the dessert is interchange revenue. Surely this is no way to regulate such an important industry. In Europe, payments are edging toward more utility-like regulation and being separated further from banking regulation, as they should be. The US could do worse.

These are personal opinions and should not be misunderstood as representing the opinions of�
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Taxi for cash!

by

[Dave Birch] Some years ago, Ronnie O’Toole from the Central Bank of Ireland was kind enough to come along and give a talk at our annual Forum in London. Apart from the fact it was a terrific talk in all respects, I always remember it because he brought up the topic of taxis as a benchmark for cash replacement and this struck me at the time as the perfect prosaic platform to assess the evolution of alternatives. As anyone who reads this blog will have noticed, I’ve continued to annoy taxi drivers around the globe almost continuously since then. I’m writing this in a Florida hotel room and I paid the taxi to get here using a card. Admittedly, the driver took the payment using a circa-1959 zip-zap machine, but hey, at least I didn’t use cash.

As was discussed back at the Digital Money Forum, after an excellent presentation by Ronnie O’Toole from National Irish Bank, a significant step toward cash replacement would be for taxi regulators to insist that cabs take contactless. This was part of the bank’s submission to the Irish Department of Finance: “The taxi regulator should make it compulsory for all taxis and hackneys to accept payment by debit or credit cards by the 1st of November 2008”.

[From Digital Money: User inexperience]

They didn’t, as far as I know, but I’m happy to report that when I jumped in a cab to go and listen to Ronnie (amongst others) at the International Cashless Society Roundtable (ICSR) 2013 in Dublin, not only was I able to pay by card, I was able to pay by card to the driver’s mobile phone! I knew Ronnie’s benchmark was good one. Taxis that don’t take cash are the hallmark of a civilised society.

We didn’t spend too much time on taxis as a specific sector at the round table, but we did have a series of genuinely interesting discussions — many of them grounded in the new Irish National Payments Plan — about the steps on the road to a cashless society. This is taken very seriously in Ireland because the payment system is particularly inefficient, with high levels of cash and cheque usage. Ronnie had just written an article about this for the Central Bank of Ireland Quarterly Bulletin (it’s “The Usage, Cost and Pricing of Retail Payments in Ireland” on page 74), and he explained the problem in some detail.

Ireland has the second highest usage of cheques in Europe, the highest ATM withdrawal per capita and still pays out half of all social welfare payments in cash. Cheques are a very expensive form of payment, and much less efficient than debit cards. Ireland could save up to €1bn per year by migrating to more efficient payment instruments. One impediment to a faster migration is that the pricing of payments in Ireland is not commensurate with the cost of provision.

I think this is a particularly important point. It came up on the lobbyists panel at the CNP Expo in Orlando this week as well and I’ll blog more about it when I’ve got time. Ronnie had some numbers to hand:

Only 46% of the costs of providing cash and cheques services are recouped by banks, with significant cross- subsidisation at the expense of electronic payments… Banks in Ireland suffered combined losses of €172m in the provision of cash and cheque services in 2009, which were largely offset by their highly profitable credit card business, which showed a profit of €140m.

The efficient electronic payment systems are being forced to subsidise to inefficient paper payment systems. Why is this allowed to continue? Surely it should be a goal of any national payment strategy to reduce the use of cash and cheques in favour of electronic alternatives and not, as Chancellor George Osborne advocates, leave cash alone and make cheques clear slightly quicker. If people want to carry on using cash and cheques then fine, but make them pay for it.

To the argument that “well, it’s poor people who use cash so if you increase the cost of cash you will punish the poor” I say this: people who are trapped in the cash economy already pay far higher transactions costs than people who are not.

ICSR 2013

I really enjoy this kind of event: real experts taking part in real discussions. I felt that I learned something from every exchange. So many thanks to Dr. Fergal Carton from the Financial Services Innovation Centre at the University College Cork for pulling it all together. I’m looking forward to the 2014 event already.

These are personal opinions and should not be misunderstood as representing the opinions of�
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Just popping out to get some gold

by

[Dave Birch] As the Bitcoin mania continues to evolve and the price of gold continues to fall, I am surely not the only person to have noticed an overlap between the people who want to use both of them to replace the, as they see it, broken system of fiat currencies. Given that almost the entire population of the world have never heard of Bitcoin, and wouldn’t understand it even if they had, it is I suppose unsurprising that in these difficult economic times, finding new ways to use gold has become the more widespread focus for innovation. For example, starting a couple of years ago, there were a flurry of stories about gold-dispensing ATMs. Here is an example from Turkey.

Thus far, all 64 Kuveyt Turk ATMs installed in Istanbul have been upgraded to offer 1 and 1.5 gram ingots of gold bullion as well as banknotes. The bank has contracted with Wincor Nixdorf to retrofit the facility to its national network of 180 machines by year end… The mini gold bars are not dispensed through the banknote output chute, but via a special coin output module that is retrofitted to the ATM. The gold bullion is packed inside a transparent plastic coin roughly the same size as a two-euro coin.

[From Finextra: Turkish bank retrofits ATMs to dispense gold ingots]

While I can’t imagine any reason to use one of these, the fact is that there’s quite a few of them around. I understand there are some specific cultural reasons for people wanting to stick gold under the bed instead of euros, but I’m unconvinced it is good economics. I guess also that I just don’t move in the right circles.

Germany’s TG-Gold-Super-Markt installed a gold bar dispensing ATM in the lobby of Abu Dhabi’s five star Deluxe Emirates Palace hotel last year, and outlined plans to roll out 500 of the machines in Germany, Switzerland and Austria.

[From Finextra: Turkish bank retrofits ATMs to dispense gold ingots]

In the US, too, a similar inexplicable development.

In the US, PMX Gold has set up a banking division with the aim of introducing gold dispensing ATMs nationide follow a pilot run at a shopping mall in Boca Raton, Florida, that saw $270,000.00 in gold sales dispensed through one machine in roughly two and one half months

[From Finextra: Turkish bank retrofits ATMs to dispense gold ingots]

I really don’t get it. Why would anyone mess about with physical gold that you can drop, lose, have stolen etc. And I bet it’s hard to buy anything from Amazon with it. I’m more than happy for people to send me gold (you’re welcome to try the experiment) but generally speaking I’d prefer the dematerialised version sent to my Goldmoney account. As an aside, Forum friend James Turk from Goldmoney will be at the PaymentsForward breakfast briefing on alternative currencies in the City (of London) on July 1st. As will I. Meanwhile, as noted, the Turkish case isn’t all about transactions costs and economic efficiency.

The bank says it wants to become Turkey’s leading retailer of gold to consumers, where demand is driven by the local tradition of investing savings in gold and making gifts of gold on the birth of children and at weddings.

[From Finextra: Turkish bank retrofits ATMs to dispense gold ingots]

Aha. It isn’t really about payments at all. People carrying gold bars are not carrying them as an alternative to a debit card.

The suspect was arrested shortly before boarding a Lufthansa flight for Germany, according to authorities. An inspection by customs officials reportedly revealed that his luggage contained 7,185 kilograms of gold and 293,435 euros in cash. The same suspect is believed to have attempted to smuggle out another bag containing 425 kilograms of silver.

[From ekathimerini.com | German held for trying to smuggle ton of gold, silver out of Greece]

If you travel first class and are a premium member of the frequent flyer club, you still only get 128Kg.

4 bags up to 32 kg each

[From Lufthansa ® – Free baggage allowance for tickets issued with effect from 1 June 2012]

Not very forward thinking of our German friend. Maybe his scales weren’t working properly. I’m sure he was moving his bullion out of Greece for entirely legitimate reasons and I don’t doubt for a moment that it had been earned through entirely legal means and that all appropriate taxes had been paid. But in case you are interested in using gold for criminal purposes, I’d advise you to stick to the virtual stuff. Much safer.

No way to determine if gold you buy is from “legitimate” sources, not “account cleaning”… After cleaned, account is sold to gold spammers used for spam until banned

[From Annotated Chinese Gold Farmer Interview via Markee Dragon – PlayNoEvil – Game Security, IT Security, and Secure Game Design Services – Contact Us at ceo@secureplay.com]

Mining virtual gold and using it smuggle value across borders seems to me to be far simpler, and far less likely to result in arrest, than using the real thing.

These are personal opinions and should not be misunderstood as representing the opinions of�
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Not just contactless, but M&S contactless

by

[Dave Birch] I rather like contactless cards. I like contactless watches more. And I like contactless phones even more than that. I’m a contactless fan. I find it rather convenient to nip in to get a coffee without having to remember my wallet, since I’ve always got my phone in my hand. I’m quite attached to my splendid Barclaycard OnePulse card: it is a regular chip and PIN card, contactless card and an Oyster card all in one. When I head into London for the day, I don’t take my main wallet with me (I’ve explained my simple three wallet system before) just my hip wallet with the OnePulse and my coffee loyalty cards. I wish there were more places that I could use it – principally the nice coffee shop on the platform at Woking station – but there you go. In this, as in so many other things, I remain in a minority.

According to a new study conducted by retail banking and ePayments software provider, Compass Plus, only one-in-10 British consumers reported to making a purchase using a contactless card in the last month, and 40 percent don’t even know what NFC payments technology is.

[From 05 – Are UK Consumers Clueless About Contactless Cards? | PYMNTS.com]

One of the places where I use my card, watch, phone or whatever else I happen to have with me is Marks & Spencer. Which reminds me. Not just contactless, but Marks & Spencer contactless, has been in the news of late.

But customers who got in touch with the Money Box show on Radio 4 said they were charged when the plastic was in their purse and well away from the readers – meaning they unwittingly paid twice. And sandwich chain Pret A Manger is said to be investigating similar claims by a customer whose card was more than 11inches from a reader.

A victim of the M&S error, identified only as Rosemary, told Money Box her Smile card was activated about a foot away from the reader at a store in Chichester, West Sussex – even though she was paying with her Lloyds debit card instead

[From Customers charged twice for items because contactless cards were activated from their pockets | Mail Online]

As I told the BBC researcher when I was asked about these reports, I think it highly unlikely that M&S is a source of dark energy, cold fusion or electromagnetic fields that defy the laws of physics. I simply do not believe the claims that the terminals read cards that were a foot away from the readers and nor do I believe claims that customers were “accidentally” double-charged. As someone observed in response to The Guardian article on same,

Not wanting to accuse anybody in the article of telling fibs but this doesn’t add up. Surely if the till took payment via contactless payment, how does then ask for the same payment again via Chip and Pin; i..e once payment is receieved said till usually spits out a receipt. [From Contactless cards: how safe is your money? | Money | The Guardian]

So let’s deal with this double-charging first. As you know, we’re not Powerpoint-and-waffle consultants, we’re get out and get real consultants. So Stuart and I set off to M&S with a variety of cards and tried transactions in more than one terminal. And you just can’t accidentally double charge. If you put a contactless card in the read range of the terminal, it executes the transaction just as specified. You can’t then insert a chip and PIN card and do another transaction – there isn’t a transaction pending. In order to pay twice, you would have to ignore the receipt that’s been printed out by the terminal and proceed with another transaction. I don’t see how this can happen accidentally. Maybe it’s a matter of staff training. If I was the checkout person and someone said “can you ring that up again”, I might ask why.

I’m sure that’s what happening, but the idea that the terminal might read both the contactless and contact cards and charge both needed further testing. Just because we couldn’t make it work in M&S doesn’t mean we couldn’t make it work elsewhere. We got out a Vx820 (this is the Verifone terminal that is used by M&S) and tried to replicate the failure mode, but we could not. When the chip and PIN card is inserted, the contactless interface is turned off correctly. We couldn’t get both types of card read simultaneously.

Terminal Testing

So the problem must be that someone swings their purse or their handbag or wallet over the contactless reader while searching for a chip and PIN card but they can’t be double-charged without a non-accidental intervention. Incidentally, on the way back from M&S we popped into Starbucks and discovered to our surprise that they had Vx820s installed as well, so we tried the experiment there too.

Now on to the claims that the terminals are reading cards from people’s backpacks. Is it plausible that the configuration of the M&S terminals means that customers are resting their handbags, wallets, purses or whatever on the readers so that their contactless card gets charged? Yes it is. Is it plausible that they are reading them a foot away. No it isn’t. Although I have a theory (strictly speaking, I should say that Stuart deduced a theory from the evidence of our experiments) as to what is happening.

But first, I wanted some facts. Since Consult Hyperion knows very literally everything about EMV, contactless, NFC and retail payments (we work for the issuers, schemes, card manufacturers, terminal manufacturers, acquirers and everyone else in the value chain), I went back to the office and pulled a few strings, called in a few favours, made a couple of calls. Well, actually, I went to talk to Katie Facey, who runs the Consult Hyperion test laboratory if we had any Vx820s around. It turned out that we did because we were messing around with them for one of our international clients, so I asked her to put a Vx820 into Marvin and run a test cycle for me. Marvin is a our custom-built robot test rig for contactless and NFC. It’s a six-axis, laser-calibrated, computer-controlled marvel. With the Vx820 loaded, we set Marvin running to slowly bring contactless cards into range from different sides and measure how close the cards had to be to carry out a transaction.

Vx820 in test rig

Here are the test results.

Contactless Card PositionDistance to Read
From Screen7cm
From Keypad1cm
Between Screen + Keypad6cm
Screen Right2cm
Keypad RightNo txn
Screen Left3cm
Keypad LeftNo txn
Reader Top1cm
Reader BottomNo txn
From screen, back of reader1.5cm
From Keypad, back of readerNo txn
Between screen + keypad, back of readerNo txn

So, the terminals work as advertised and the maximum read range is not 30cm-40cm but under optimal conditions only 7cm and then when the card is placed dead centre to the screen over the contactless symbol. I think the 7cm gives us a clue as to what is happening.

I wander into M&S a buy a vanilla fudge bar. I have my wallet in my hand. I open it to take out my chip and PIN card. At this point, I am holding my wallet over the reader, less than 7cm away. There’s a contactless card in my wallet and the terminal reads it. I don’t see it register a payment because my wallet is covering up the screen of the PIN pad. I put my wallet in my other hand, or on the counter, or in my pocket or wherever 30cm-40cm away. Now I put the chip and PIN card in the reader and I notice that the transaction has completed because the contactless card (now 30cm away) has been read, so I write to The Daily Mail. Mystery solved.

I think, by the way, that it doesn’t do any of us (in the industry) any harm to read some of the general public’s comments on this story. Here are a few of the comments on the Guardian’s version of the story. (In which Charles Arthur was kind enough to quote me.) I would not, for one moment, want to mislead you into thinking that people who respond to articles in The Guardian are in any way a cross section of the great British public, but nevertheless the comments are worth leafing through.

  • “This is the first that I have heard of contactless cards” which seems to confirm that survey results that I started with.
  • Then there was the cautious “So far I have not been offered a contactless card. Just as well, as I would never consider using one – far too risky”.
  • I appreciated the Ocker vote of confidence: “You’re all a bunch of paranoid luddites (tautology?). Contactless payment has been the norm in Australia for a couple of years now (with a maximum purchase value of $100 without a PIN) and there have been no reported problems yet”.
  • There was also the untrue “apps exist which draw down the encrypted data, it’s not difficult to find code online which decrypts this data and re-writes it to a phone, blank card or even hotel key card”. All of this is incorrect. The data isn’t encrypted, although it does carry a digital signature formed from a private key inside the chip (this is why you can’t clone EMV cards – because there’s no mechanism for reading this private key). You can’t re-write this data to make a counterfeit magnetic stripe card because the data passed over the contactless interface isn’t the same as the data on the magnetic stripe. As an aside, years ago a friend of mine rewrote his debit card stripe onto a coffee card that he took with him on his travels a couple of times. Thus if the card got lost or stolen, it would not appear of any value to a criminal! Sadly, since the advent of chip and PIN this avenue of fun has been blocked off.
  • There was also the pragmatic “I just have my oyster card on the other side of my wallet to the contactless credit card”, reflecting on the problem that a number of people have remarked on where if you present a contactless card and an Oyster together to an Oyster reader then they don’t work.
  • I loved the realistic “For a shop, debit cards are cheaper than cash, unless they are factoring VAT and income tax into the calculations”. It’s shame that I have to “factor” income tax into my own salary, but I can see why some shops might prefer not to.

My favourite, of course, was this one:

if this guy said no way its not the cards, id be reassured, but clearly, this so called ‘consultant’ has no idea of the capabilities of NFC technology. he maybe a consultant, but not of payment technology, thats for sure.

Oh no. Rumbled. I’m afraid “toothbrushrampage” has seen through my obviously faked photographs, my bogus test results and my so-called “measurements” to uncover the conspiracy. Yes: the banks are in it with Marks & Spencer! The banks have been issuing cards that M&S terminals can spy on while you drive past in your car, thereby occasionally charging you twice for the same sub-£20 transaction and hoping that you won’t notice it. It was a brilliant plan, and we might have got away with it if it hadn’t been for you darn kids.

These are personal opinions and should not be misunderstood as representing the opinions of�
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Mobile money platform migration

by

[Paul Makin] In recent months we have started seeing an increasing number of mobile money operators seeking to move on from their existing platforms, and migrating to new platforms. In general, rather than any capacity issues, this appears to be due to dissatisfaction with the existing platform, be it functionality, or reporting, or security, or any of a myriad of other concerns. Unfortunately, these replacement platforms seem to be selected too hastily, often giving the impression of mild panic rather than careful consideration.

As a consequence we are being asked more and more often to recommend a platform.  This puts us in a difficult position, because frankly we are not aware of a platform out there that we can wholeheartedly recommend. Consider the two broad classes of platform: those specifically aimed at, and developed for, this emerging sector of mobile money; and those that are adapted from the banking sector usage for which they were developed.

Pure mobile money platforms are often supplied by technology-focused organisations, whose roots are in the mobile industry – these can be suppliers of (for example) prepaid airtime systems, or network infrastructure, or billing systems, though pure mobile money technology startups are also prominent in this category. These organisations generally understand the technology at a deep level, and can (usually) supply you with a reliable transaction engine. But these platforms are generally deficient in the more mundane areas that, whilst not sexy, are absolutely crucial to the success of a service – areas such as:

·         Sophisticated reporting tools, for general management of the service, and for active fraud and money laundering detection and management;

·         Proper bank-grade security features, such as role-based access controls and countersigning of value movements;

·         Support for, and integration with, internal management processes, in order to develop institutional robustness;

·         Tools for the management and training of agents and agent networks.

In contrast, platforms evolved from the banking sector have many of these features already (with the exception of the mobile money-specific features, obviously), but they fall down in their adaptation to this new sector:

·         They are too closely fitted to the conventional operational and management structures of a bank;

·         The terms on which they are offered generally mirror the conventional business models of banks, for example by tying costs directly to customer numbers, which makes the platforms unattractive to mobile money operators (including banks wishing to offer mobile money services).

So what is to be done? Well ideally I’d like someone to offer Consult Hyperion and its Associates the chance to specify and manage the building of a second generation mobile money platform  – after all, we have probably unrivalled experience in this sector, amassed since 2004, across a range of mobile money operators and platforms. But back in the real world, I’d recommend that mobile money operators follow the conventional path of service development the world over:

·         Work out precisely what your organisation wants and needs, and document it in a detailed, formal Requirements Specification. And don’t limit this to just the technical requirements.

·         Use the Requirements Specification as the basis of an RFP, and issue it to as many reputable suppliers as you can identify.

·         Formally score the responses you receive, in order to establish an audit trail of decision making.

Generally, I’m hoping to see mobile money move over the next few years from the current ‘gold rush’ state, to a more prosaic ‘business as usual’ state of mind.

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

Necessity is the mother of identity

by

[Dave Birch] This is a blog about electronic transactions, not politics, and I do not want to be accused of introducing a political perspective. But I think it is fair to observe that there are tensions in trying to balance the free movement of people within the European Union and the exigencies of a collapsing welfare state. I mention this only because I want to discuss the practicalities of identifying and authenticating people for the purposes of distributing welfare benefits. And, to avoid any suggestion of parochialism, let me start by noting that this is not a specifically British problem.

Once in the Netherlands, the Bulgarians registered as residents at addresses rented by accomplices, and then applied for rent and child-support subsidies. They were able to open Dutch bank accounts to receive the social subsidies, and then to return to Bulgaria and withdraw money from cash machines. The ringleaders took a cut of the proceeds.

[From Dutch uproar over Bulgarian benefit fraud – FT.com]

The best part of this story, by the way, is in the denouement. The fraud was not uncovered, as you might have thought, by diligent investigation on behalf of Dutch taxpayers or the sophisticated quantum-computing anti-fraud neural network super-computer cluster at the Dutch DWP "Big Data" analysis centre…

The fraud came to light when some villagers complained to Bulgarian police that they had not received payments they had been promised as part of the schemes.

[From Dutch uproar over Bulgarian benefit fraud – FT.com]

In Britain, the mounting panic over immigration and its relationship with welfare distribution is leading to what some observers have labelled knee-jerk irrationality. In particular, the minister "in charge of" the National Health Service (NHS) has found himself caught up a bit of row about all this sort of thing, between the scylla of ill-informed public outrage and the charbydis of soundbite politics. The minister, Jeremy Hunt, is responsible for

a new ‘do-it-yourself’ immigration law unveiled today as the centrepiece of the Queen’s Speech. It will require GPs, hospital staff and landlords to police the new legislation.

[From The Queen's Speech: Immigration Bill passes buck to doctors and buy-to-let landlords | News | The Week UK]

How a doctor or a landlord is supposed to determine who I am or what my immigration status might be I haven't the slightest idea. And if I were a landlord, I'm not sure I'd care. If someone turns up with a birth certificate (that I cannot possibly verify) showing me they were born in the UK or a Bulgarian passport (that I cannot possibly verify) telling me they are an EU citizen, I can just tick a box to say that I've seen the documents and I'm off the hook.

So what has this to do with thought leadership in secure electronic transactions? Well, there is an inevitable destination on the badly-folded roadmap in the hands of the government. The fundamental British distaste for state identity documentation (which I share) prevents rational discussion on the topic, but the truth is, in true tabloid headline style, "something must be done". Identity is a mess, and it's getting worse. In our world of retail transactions, identity is a cost and a source of chaos and frustration. But, clearly, since we still log in to our home banking and shopping services using email addresses and passwords just as we did fifteen years ago, the problem isn't bad enough to warrant concerted action. I wonder, however, if access to welfare might turn out to be the fraud straw that broke the identity camel's back, so to speak.

British citizens could be forced to carry ID cards to access free NHS care as part of crackdown on health tourism

[From British citizens could be forced to carry ID cards to access free NHS care as part of crackdown on health tourism | Mail Online]

This is not, as it happens, what the Mail's own story actually says. The story refers to an "entitlement card". There is a great difference between the two. For those not versed in the recent history of the UK's catastrophic attempts to introduce an ID card, let me simply highlight that when the then-Labour government introduced the idea of entitlement card in 2002 (Consult Hyperion were one of the organisations that responded to this consultation process – not that anyone ever paid any attention whatsoever), I thought it might be an opportunity to introduce a key Privacy-Enhancing Technology (PET) infrastructure for the new millennium and was rather in favour of the idea. The government, though, eventually abandoned the entitlement card idea. The Home Office under David Blunkett decided to introduce an identity card instead and in 2004 awarded a contract to PA Consulting as the "development partners" for such a scheme. This, which is what people are referring to when they talk about the "UK ID card", was eventually abandoned in 2008.

It was flawed from the start, and as a showcase for the British technology industry, it was an embarrassment: it provided none of the services that the identity cards systems in advanced nations (eg, Germany, Hong Kong, Estonia) provide and there was never any evidence that it would do so.

[From Digital Identity: Back to the future of the ID card]

When I was asked to give evidence to the House of Commons Science and Technology Committee in 2006, I thought that the clear distinction between an entitlement card (good thing) and an identity card (not a good thing) might persuade the government to change direction and go back to the original Home Office vision. A properly-implemented entitlement card could be a key way to provide privacy in an online age, because it would shift the standard mental model of the citizen-state nexus from "who are you" to "what are you entitled to" with identity removed from many transactions completely. All water under the bridge now.

Meanwhile, across some other water, our neighbours in Eire had decided that an entitlement card was the right way forward and they began to draw up plans for what became known as the Public Service Card. (Before the e-mails pour in, let me be transparent: Consult Hyperion are consultants to the Irish government on this project.) The card went live last year and is seen by the Irish government as an essential component of its campaign not only to reduce welfare fraud but to deliver efficient electronic government. They are looking at extending its use in a number of directions.

The Department of Health is in discussion with the Department of Social Protection, The HSE and the Department of Public Expenditure and Reform on using PSC infrastructure in support of a health Identifier.

[From e-Government Reporting]

One obvious and privacy-centric way to do this is to use a cryptographically-strong one-way function to generate the health identifier from the PSC identifier (e.g., by hashing) so that when a citizen presents a PSC it always connects to the correct health records but if bad guys get into the health records they can't get back to the PSC identifier. These are well-known techniques and, to be honest, no different to the suggestions around entitlement cards that we made to the British government back in 2002.

My point is that it can only be a matter of time before UK has to introduce a similar kind of entitlement card, so doesn't it make sense to begin a sensible and measured planning process for this now — using the Cabinet Office Identity Assurance (IDA) framework — instead of being panicked into buying some sub-optimal collection from vendors at the last minute? Rather than build an electronic identity system that embodies the concepts and values of physical identity cards from a generation ago, surely it is better to design a fit for purpose identity infrastructure for the 21st-century and then provide physical smart cards that implement it. In this model, the privacy broker in the smart card and the mobile phone, watch or hat would be no different and the ubiquitous, standardised deployment ought to trigger the rapid evolution of value-added services on top of that basic infrastructure.

I don't want the government to develop some nutty jumbo IT system to help landlords, or doctors or anyone else. I want an infrastructure. The entitlement card concept from 2002 deserves to be brought out of the cupboard and dusted off and (with Consult Hyperion's response to the consultation taken as the core specification document) and then the implementation can re-architected for the new world of mobile phones, identity assurance and the interweb tubes.

These are personal opinions and should not be misunderstood as representing the opinions of 
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

The mobile money paradox – if everyone wants it, why is it doing so badly?

by

 

[Susie Lonie] Ever since the launch of M-PESA in Kenya in 2007 the payments world has looked upon mobile money (MM), the precocious newcomer to financial services in anticipation.  There are in excess of 160 live MM services being operated around the world right now, but despite high expectations created by success in Kenya, only a handful have thus far reached critical mass.  (It is generally accepted that a MM service is successful, i.e. can break even and move into profit, when it has about one million active subscribers who are each performing at least one transaction per month.) To have less than 10% of these services successful by this standard six years later is pretty dismal and is the mobile money paradox: consumers want to buy it and businesses want to sell it; yet the industry is neither flourishing nor profitable.

So what is going wrong?

The runaway success of M-PESA in Kenya led many companies to believe that MM is an easy win at relatively low cost and with little effort.  Dazzled by huge customer numbers (for several years M-PESA recruited over 50,000 customers every week) and millions of transactions every day, most have failed to understand that M-PESA’s success in Kenya was neither cheap, nor easy.

The greatest cause of poor performance stems from the culture of the companies offering MM. Grounded in the assumption that it is closely aligned with their core business, telcos treat MM as a value-added service (VAS) akin to launching a mobile internet portal, blithely expecting it to fit within their normal operations.  Meanwhile, banks assume that it is just another kind of mobile banking service, closely aligned to their core business, and able to fit easily into their existing infrastructure.  Whilst MM shares many characteristics with both telecoms and banking, these assumptions are profoundly incorrect.  Companies that have succeeded, whether telcos or banks, have recognised that operating an MM service requires a dedicated team of specialists and operational procedures which depart significantly from their normal practices.  They have also recognised the need to invest significant sums of money into both internal operations and to marketing a new service to traditionally hard-to-reach consumers.

Launching MM is an expensive business.  Creating an agent (branch) network, training it, and maintaining the agents’ engagement in the early days when they have few customers, and therefore little revenue, is not a task for the fainthearted.  Each agent must be persuaded to invest their cash in an e-money float account; cash which could otherwise be used to buy traditional stock for their outlet.  Agents must be incentivised to provide a return on this investment which is sufficiently attractive for them to divert resource from their core business until the service reaches critical mass and becomes a significant income stream.  

Meanwhile, most target customers are utterly unfamiliar with the concept of MM and significant marketing effort is required to educate them on what the service does, how they use it, and why they should trust it.  This requires a hands-on “below the line” approach to marketing which is a far cry from the bank/telco preferred approach of offering high value customers the latest technology via large-scale multimedia advertising campaigns.

Another factor inhibiting success is a regulatory environment which is usually unclear and can be highly restrictive.  Most regulators are just starting to learn about MM, the opportunities to improve governance offered by the technology, and where the risks lie.  Meanwhile, the banking culture tends to be cautious and risk averse.  If in doubt they will err on the side of over-interpreting regulation and imposing restrictive practices unsuited to the low risk associated with low value transactions.  Further, banks nurture their relationship with the regulator very carefully and are disinclined to challenge inappropriate regulation for the new and unproven MM service and in doing so, potentially put their core banking relationship at risk.  Telecoms companies, on the other hand, generally do not have a relationship with the financial regulator and many do not understand the complexities of adhering to their requirements.  By nature telcos are entrepreneurial and willing to make mistakes and they have more appetite to push back to the regulator, if they have the internal expertise to fully understand their options.  Sadly, many do not have this resource and just accept a poor interpretation of the law as the way they must operate. This then becomes their excuse for lacklustre performance.  When regulation requires banks and telcos into formal partnerships, the cultural dissonance can lead to misunderstanding, delays, and excessive regulatory controls as the two compliance teams try to out-do each other as worthy upholders of the law.  

The MM industry is still underdeveloped and largely unproven. The opportunity it provides to serve the large segment of un- or under-represented “poor” is clear and the success in East Africa demonstrates just how transformational it can be.  However, many organisational and regulatory challenges need to be overcome for it to reach its full potential.  If these are not grasped and resolved, mobile money stands in danger of being written off as a niche product with specific application in just a few markets which “just happen to have the right conditions”.

 

Susie Lonie is an associate with Consult Hyperion. If you are interested in becoming an associate too, contact lindi.friel@chyp.com

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

How do I pay thee, let me count the ways

by

[Dave Birch] So last week in New York I used chip, contactless chip, stripe, Google Wallet, LevelUp, retailer stored-value, cash and card-on-file to retailer app. They all worked, but none of them worked reliably and ubiquitously, which were two of David Grigg’s watchwords in his excellent kick-off talk give a Bank of America perspective on the second day of the excellent Wallet Wars conference. Actually, that’s not quite correct: my chip and PIN debit card worked perfectly in the Citibank ATM and both of my retailer apps worked perfectly. But I did have problems all week*.

  1. I forgot the PIN on my Simple card so I had to call and reset it (after which it worked perfectly).
  2. My UK EMV contactless credit card was declined, for no reason I know of.
  3. Google Wallet wouldn’t work in taxis (I tried three times) although it did work in Duane Reade. Bizarrely, I still had to sign for the transaction — even though there is no signature for them to compare it against, even if they ever checked the signatures, which they don’t — and they still gave me a paper receipt.
  4. I took three or four attempts to get the reader to see my LevelUp QR code. In the end the clerk took the phone from me and held it closer to the reader and it worked then. To be fair, he did tell me that he thought it was cool and that other people had used it.
  5. I was forced into using cash because I went to a diner for lunch one day and didn’t take the basic precaution of asking if they took cards or if they were a front for a triad money-laundering operation. When the check came I handed over my card with a flourish only to be told it was a cash-only deal. So I had to use the ATM they have in the diner (which cost me like $3) to get out some money to pay. So cash didn’t really work for me either.

I’m not sure I completely agree with David. Reliable, yes. Ubiquitous, no. I have a RingGo app that I can only use to pay for parking, a Hailo app that I use to pay for cabs and an Arriva app (**) that I use to pay for the bus. This isn’t ubiquity but it really doesn’t matter. It’s what Tim Jones (in his SimPay days) called “branded ubiquity”.

But as Tim Jones mentioned in his podcast, in retrospect geography didn’t work for Mondex and VisaCash, so it’s better to go for branded ubiquity (eg, all NCP car parks) than focus too tightly on specific areas.

[From Digital Money: Contactless UK is on the way]

The reason for this is that a key element in the uptake of a new payment system is certainty of tender. Consumers need to know that when they present their card, phone, watch or fingerprint that it will be accepted. If they know for certain it won’t be accepted, then they won’t present it. This is not a problem. I know that MacDonalds have contactless and I like their coffee, so in the morning at Waterloo station I’ll get one of their coffees and tap and go. I know that some other retailers don’t have contactless – so if I’ve forgotten my wallet when cycling over to the office, I won’t bother stopping at Retailer A, I’ll stop at Retailer B. It is uncertainty that I don’t like.

Branded ubiquity contributes to certainty of tender. Now, the card schemes have ubiquity (which doesn’t mean that everything works fine ***) and that is a big, big advantage in a world of wallets that only have three slots. But in a world of wallets with infinite slots, it’s less of an advantage because it is entirely possible that branded ubiquity can substitute for scheme ubiquity. Multiple apps with underlying scheme APIs or direct-to-bank account solutions will, I think, compete with the scheme ubiquity at POS. Indeed, another one (somewhat like the imagined MCX solution) launched this week in Germany.

German discount supermarket Netto is rolling out mobile payments for customers with smartphones, dpa reports. It has launched a mobile app which recognises scanned items at the checkout. This will allow customers to pay for their goods direct from their bank accounts using their phones. The system will be rolled out across more than 4,000 Netto outlets from mid-May.

[From Netto rolls out mobile payment app in Germany – Telecompaper]

All things considered, branded ubiquity is winning the war for my mobile spending. In a typical week, I spend far more through RingGo, Starbucks, Hailo, Arriva, Chipotle (and now KFC in the UK!) on my mobile than I do through my mobile NFC interface that emulates a standard card. Having said that, I think I spent more using my contactless watch in a typical week than I do using my NFC phone, but they may be just a phase.

* And this week too. I just to tried to spend £1.49 on the marvellous “Cards and Payments Intelligence” at iTunes and the transaction was blocked. When I tried to log in to my John Lewis MasterCard account to try and see what the problem was (thinking it was because I’d used the cards last week in that hotbed of fraud, the United States). Indeed, it was America that was the root of the problem, but in fact it was because my wife had unwisely attempted to use her card to buy something online in the USA. The transaction was blocked, as it would have been by any right-thinking card issuer with an interest in reducing fraud. Unfortunately, that meant her card was also blocked today when she attempted to pay a medical bill. Still it only took a quarter of an hour, a Skype call and two international calls from my mobile phone to sort things out. It also turned out that John Lewis had tried to phone me a couple of times, but because I don’t answer calls on my mobile that come from unrecognised numbers and they didn’t leave a message, I had no idea that 0113 298 XXXX was an important call about my credit card and not some ambulance-chasing lawyers trying to persuade me to claim for whiplash because my wife’s car was rear-ended a couple of days ago.

** The Arriva app annoys the hell out of me. I’ve used it for a couple of years and the only kind of ticket I have ever bought (and I’ve bought lots of them) is a one-day bus pass for Woking. Yet every time I run the app I first have to select “South East”, then “Woking” which is at the end of the list, then “One Day”. Why can’t the damn app simply default to the same ticket as last time? There are some basic UX lessons about the switch from web to app, people.

*** When people tell you the current system of cards and authorisation and authentication and settlement works well so why are our clients messing around with chips and mobiles and 2FA and apps and APIs — it doesn’t. How much money was simply wasted blocking my card and blocking my wife’s card and then having to resolve this through a call centre (which, to be fair to John Lewis, was friendly, helpful and efficient).

These are personal opinions and should not be misunderstood as representing the opinions of�
Consult Hyperion or any of its clients or suppliers

These are the personal opinions of Consult Hyperion and its guests and should not be misunderstood as representing the opinion of its clients or suppliers. To discuss how any of the technologies discussed in this post can benefit your business, please contact Consult Hyperion.

RSS Recent Posts

RSS Recent Comments

RSS Recent Mobile Money Practice blog posts