Mobile Swipe: Risk is Behavior … not Security

11 March 2011

I’ve been rather unambiguous in my views on Square. Yesterday I received a number of calls from my card friends, with over 50% in support of Square. After pondering their feedback, my bigger concern is customer behavior… a concern that expands beyond Square to all swipe based mobile payments (although I still feel quite strongly that they are not playing by the rules that everyone else agreed to).

For background, beyond my role as alternate channels head for Citi (Outside of the US), I also led sales and marketing for a little start up backed by Kleiner Perkins (41st Parameter) that focused on fraud. Through this role, I was fortunate to develop relationships with the fraud heads of every major US and UK bank and card network. Truly fantastic people… think of them as a mixture of James Bond, CSI, and Elliott Ness (Famous FBI guy). To be honest, I never saw these fraud teams during my time as a banker, and never really appreciated their role in keeping the banking system safe.

Frank Abagnale (of Catch me if you can) was on 41st’s Advisory Board. 40 years ago, this was the kind of fraudster that the bank’s team had to track down.. one guy in a garage with a printing press (magnetic ink). Today, the nature of fraud has changed tremendously. Well organized rings are flourishing, one of which has over 500 employees with product, engineering, marketing, sales…. a specialization of labor. Phishing was a great success, as customers responded to e-mails looking legit. Banks responded with improved online security. Fraud rings responded with malware and “man in the middle” attacks.. point is that this is a dynamic war taking place and bank fraud teams are the “special forces” that crack the code.  The online fraud environment is the most complex battlefield of all. 

It takes resources to win any battle. To give you an idea of the size of risk, gross fraud (attempted) at PayPal was around $500M dollars last year. Through technology and people, PayPal reduced that number to under $50. Bank margin is driven by the ability to manage risk; this is the nature of banking. The top banks, Paypal, Amazon and Apple all have world class teams and resources in this area… thus they seek both higher margin (ie risk) and volume. In essence they “compete” by managing risk more effectively than their peers. A well known axiom applies: If a hungry bear comes into your campsite, you don’t have to be faster than the bear.. just faster than all of the other campers.

There is no single solution for all of this fraud, it is a constant battle and weapons just continue to improve and evolve on both sides. For banks, there are 2 common elements to all fraud strategies: educating customers, and security of customer data. In the US, consumers are quite fortunate to have the risks associated with fraud completely borne by banks (Reg E/Z). Outside of the US if you have fraud on your credit card it is your job to prove it. Hence a UK consumer is much less likely to give their card to just anyone, which is why the waiter stands at your table with a mobile card reader for you to enter your PIN.. your card is never out of your sight.

Example story from yesterday.

Groups of brilliant fraudsters created small mini kiosks called “card cleaners” and placed them in ATM booths, grocery stores, vending machines.. “Clean your credit cards for free”..  I’m not making this up.. people really used them. The crooks just took the numbers and sent them to Algeria (a favorite destination) to create new cards, or to sell to other organized rings. The rest of world hates US use of magstripe.. we are the only country in the world that has not adopted the EMV standard (aka chip and PIN). EU readers still take mag stripe because of the US tourist dollars..

These fraudsters were successful with just magstripe. What if they had your name, e-mail, phone number, … ? If you went to the grocery store, and the clerk asked you for name and phone number and put it in her phone prior to authorizing your transaction would you provide it? This is exactly what Square is doing. Read Dorsey’s response to Verifone’s security concerns. Giving merchants additional data will not decrease fraud, but establish new patterns of customer behavior which will increase it for all. We have a “battle” within the banks today: The card business want to grow transaction volume. The fraud organizations want to protect customer information and ensure customers don’t give their data out to just any hot dog vendor on the street.

Future Scenario

A good crook would probably spend a few days developing an iPhone app that swiped your card, asked for your PIN, took a picture of the back of your card (w/ CVV), obtain phone number and e-mail address. A fraud ring sets up hot dog or ice cream stands (that only take cards) with $0.50 ice cream… they would never even use Square’s software.. or even try to submit a transactions. They would give the food away for free just to get the data.  Once I have this data, I could send within seconds to my HQ to commit ATM, online or even POS fraud in any number of countries.

Was Square’s technology any part of this? Nope.. people could do this today. Is Square encouraging a sustainable consumer behavior? Nope. Smart merchants (Apple, PayPal, …) are choosing Verifone PayWare Mobile because the device is secure.. your employees can’t put on a skimming app because the data is encrypted when it enters the phone. But do I want my bank customers examining the make and model of the card reader before they turn over there card? Heck no! So what do I tell my bank customers? Only give your cards out to merchants you can trust? Do banks incent proper consumer behavior on card use? No.  You get the picture… life just got much more difficult for the fraud and customer experience teams.

Individual issuers have the power to decline square transactions. My guess is that at least 2 major banks will begin to decline all square transactions within next month. Beyond the fraud risk, it also competes with their own mobile initiatives (Barclays/ISIS, Mastercard/RIM, …).

NFC is a step beyond EMV in security… subject for another blog.

Comments appreciated.

6 thoughts on “Mobile Swipe: Risk is Behavior … not Security

  1. The underlying meme of Square v’s Verifone is an echo of notable battles between payment incumbents (with an institutional bias towards risk management and control), and dot.com ‘outsiders’ (with an irreverent bias for simplicity and friction free operations). IMO, the notable and recent innovations ‘in’ payments have from ‘outside’ payments. Think paypal, amazon 1-click, facebook credits, or mpesa. Simple, frictionless and crucially, they control the UI with the consumer, and UIs can determine the ‘behavior’. The Issuers/Banks risk relegation to the backend.

    Verifone correctly argue that the dispute is about skimming. But not of credit cards. Rather, its all about Square skimming their business.

    Cost
Verifone reader = $179.
    Square reader = free

    Contract
Verifone = 24 month contract, boarding fee $49, early termination fee of $199.
    Square =early termination fee $0

    Transaction fees
Verifone = a “Monthly Service Fee” of $11, a “Per Transaction Fee” of $0.11.
    Square = 2.75%

  2. Its lunacy that ‘2 major banks’ may start to decline square txns: I for one will believe that if they do, their decisions will be driven much more by competing business considerations than for legitimate fraud exposure concerns.

    Ever since the square device first came out, I’ve considered it nothing more than a clever way to save typing time & avoid card # keystroke data errors on a mobile wep app form. i.e: From the network’s point of view, this is a card not present transaction.

    Even without emv, magnetic card data could be encrypted and digitally signed by the device and travel end-end to the issuer in a secure means. And even without emv, any authorization request not_so_ received by an issuer could simply be treated as card not present, with appropriate pricing and chargeback conditions applying.

    Merchants conceivably would then have a legitimate business choice – if devices like verifone which perform encryption @ the device level really do lower fraud risk, then the industry will logically reward those merchants who adopt this technology with lower fees and reduced exposure to chargeback, vs those who choose the services of squareup, no?

    Yes I know my techno-approach to solving a business problem is not going to happen. But my point is made: If the industry wants to reduce card fraud via at-source encryption, then the industry has to get operationally serious about it end-end, and the business terms and prices paid need to be better correlated to the actual network risk introduced by each swipe.

    Fud-flinging at startups isn’t the answer. Canceling the laughable cottage consulting industry currently called ‘pci’, however, might be a start…

    • The card schemes have huge motive to see Square succeed. Their vision is peer-to-peer commerce based around card-payments (swipe, nfc, bump, emv, whatever) with a focus not on the 7m merchants today, but on the 26m sole traders who could use cards and not cash. I can’t imagine they wouldn’t lean on banks denying square transactions

  3. Pingback: Square “Violations” « FinVentures

  4. My brother recommended I would possibly like this website. He was entirely right. This publish actually made my day. You cann’t imagine just how a lot time I had spent for this information! Thank you!

  5. Pingback: Digital Wallet Strategies « FinVentures

Please Login to Comment.