Equifax.. Bank Action Plan

Equifax. It’s hard to sit on sit my hands and not write on this one. My perspective is shaped through running 2 of the largest online banks in the world, developing state of the art fraud prevention systems with the top 20 banks, working with Google and today creating Commerce Signals.

Enron has new competition for the company name that denotes loss and fraud. Equifax may be the single largest breach of consumer information in history…. It is everything from social to DOBs, DL #s, …. How did Equifax get our data? Continue reading “Equifax.. Bank Action Plan”

PIN Debit at the POS

Most of you have read that Walmart, Home Depot and Kroger have launched new litigation against Visa for “PIN” and Debit.  This issue is so complex it makes my head spin… For those unfamiliar with some of the basics see this article, my prior blog on PIN debit consolidation,  AT Kearney, Digital Transactions: PIN Debit Claw Back and Pinless PIN Debit. Continue reading “PIN Debit at the POS”

Structural Changes in Payments

2 January 2015

Today’s blog is focused on discussing the structural changes influencing consumer retail payments in the US. For those interested in looking at a broader global view of all payments, I highly recommend reading the Cap Gemini World Payments Report (https://www.worldpaymentsreport.com/) .

Payment Value - highlighted

Payments have been a focus of mine for 20 or so years… it is perhaps the MOST interesting of all network businesses. Payment is a critical part of commerce and a product of it. It is the event in which almost every commercial contract is based upon. Payments can be simple (cash), complex (bitcoin), and political (interchange, rules). Payment efficacy, reliability and data are important to: consumers, merchants, banks, governments and economies.

Globally, electronic payments are still in their infancy, which makes investing in it so much more exciting. For example, over 90% of the global electronic transactions occur in the top 10 markets (representing less than 10% of the world’s population).  This would seem to point to a future where electronic payments (and the banking/commerce they represent) are poised to grow geometrically as the number of nodes grow. There is a chicken and egg argument here.. are payments the result of strong economic environments or are they the enabler? Perhaps a bit of both, but finding markets where they are growing (ie Brazil, Peru, Philippines, Kenya, … ) are worth exploring (Democratizing Access to Capital – see blog).

Not only are payments poised for exciting growth, there are also tremendous forces driving change within existing systems and networks. Investors must consider these structural changes impacting existing players across the entire value chain.

In its simplest form, payments are a brokering business which manages value exchange between two entities engaged in commerce. Logically, a broker must be removed from the transaction to maintain the trust of both parties, and deliver value through managing the financial risk associated with the transaction. My view is that Card issuing banks, have lost the neutrality of their “brokering” role by creating a card rewards system that incents card use (paid by the merchant). However, this ideal “neutral” world is NOT the nirvana that we should seek, as no one would invest and we would be stuck with cash (and SEPA in the EU .. see blog).

Complexity in payments is driven by the quest for control and margin of the various participants, not by necessity. This is what makes understanding payments so hard…. most of the changes are not logical, but political. The friction (inefficiencies and illogical design) in payments is what makes them work. As I’ve stated before, no engineer would design a payment system to operate the way we do today (see Push Payments). Thus there is beauty in this chaos! The V/MA model created incentives for 1000s of banks to invest in payments, and I doubt if we will ever see any other companies that could repeat this feat (thus my V/MA personal investments).

What changes are likely to impact the world’s oldest profession in the next 10 years? My list (in order of impact)

  1. Risk and Identity
  2. Data/Commerce Value
  3. Consumer Behavior/Trust/Acceptance
  4. Issuance/Customer Acquisition/HCE
  5. Regulatory/Rates/Rules (Fees)
  6. Mobile/Payment in the OS

#1 Risk and Identity: Authentication and Authorization

How would you authenticate someone’s identity? Best practice is to validate a combination of what you are (biometric, image, DNA), with something you have (mobile, token, OTP FOB, …) and something you know (shared secret). Apple’s new iPhone 6 is the first major consumer device that can manage all 3 securely. It is truly revolutionary.  The ability to authenticate a consumer eliminates fraud risk, and thus impacts both Account Opening and Transaction Authorization.  Both of these services in turn impact the “core” banking relationship (see Future of Retail Banking).. How do consumers choose a bank? A credit card? What is the value proposition?PIN Fraud Rate 2013 Value

Before there is payment there must be an account in which to pay from. The key to opening an account is identity (Regulatory KYC or Know Your Customer). Account Opening has been automated (and online) for over 10 years. In 2004, my team at Wachovia was the first in the world to introduce instant account opening (online) for deposit accounts (Credit Cards were just 2 years ahead of us..). 10 years ago I used products like Equifax accountChex or EWS AOA (Validating questions based on prior financial history and credit bureau data), today could I use Apple!?

Identity and authentication is changing rapidly, and if the first two paragraphs were not already enough to ponder on this topic, we must mention Bitcoin. As opposed to authenticating the person to give access to funds and services, bitcoin authenticates itself enabling the holder to be anonymous. It is a self authenticating instrument.. imagine a dollar bill that can tell you it is genuine with 100% accuracy.  Self authenticating instruments exist independently of the holder and are a store of value (ie, Gold, Bitcoin, …etc). Normally there was physical presence required to exchange self authenticating instruments (exchanging gold), bitcoin changed all of that. A virtual self authenticating instrument that can be exchanged remotely and cannot be tracked (easily). Whereas payments are instructions move money (value) from one bank (store of value) to another, a bitcoin exchange is value exchange (not instructions). bitcoinhow-100032615-orig

The power of bitcoin to disrupt payments, companies, government, economies, .. cannot be understated.  How could any central bank manage money supply in this model? How can you tax something that cannot be tracked? The growth challenge for bitcoin is in “connecting” to other payment networks and regulated entities (ie cash out).  Unfortunately the entities which benefit the most from bitcoin are those that seek anonymity… which of course impacts the willingness of mainstream (regulated) institutions to accept it.

Fraud and Risk

As you can see from picture above “risk” in payments has several components: credit risk, settlement risk, fraud risk, regulatory/AML risk, … etc. Fraud risk is the area in the most flux, both WHO owns the risk and HOW it is managed. In the US Card Not Present transactions follow the pattern of ACH and Checks in that the originator of the transaction bears the risk of loss. In a retail transaction, that is the merchant. applepayinapps

Risk and fraud management were historically the key areas where banks excelled and differentiated (big banks have multi billion dollar investments), but the merchants and platforms have now passed banks in their ability to manage it. This mobile authentication advancement had rendered the multi billion dollar bank risk investments moot (for mobile initiated payments).  Proof is in the picture above (see Federal Reserve 2013 Payment Study), all fraud has fallen tremendously! Both for Card Present, Card Not Present and even for Checks. Why? As the former EVP of a Kleiner Perkins backed Fraud Prevention company I’m not going to give you all the details, but suffice to say that identity plays a key role. Paypal, Amazon, Google, Apple all have fraud rates under 8bps, some have the around 3bps.  These numbers will get better for Apple and Google as mcommerce starts to take an ever larger share of eCommerce (see my previous blog) and they bake in biometrics into mobile payments.

A key point that investors must understand here is that the large CNP merchants have gotten so good at managing fraud, that they could care less about a liability shift. What they want is a rate reduction (risk based pricing).  After all, if you could manage fraud at a rate of 3-8bps.. what work is the bank doing to justify taking 240 for payments? The Paypal investors read this and say “ahh.. Apple and Google want to become Paypal”.. No they don’t! while Apple/Google COULD assume all the functions of Paypal, their role as commerce orchestrators is of FAR greater value. In this role you must not force a consumer to a merchant, a good, or a payment instrument. “Let the consumer decide” is the common mantra across the Google, Apple, Amazon.

The investor impact is complex. Large merchants have proven ability to manage fraud and risk, and want the consumer to choose the payment instrument of their choice. Banks ability to differentiate in managing risk is greatly reduced, and the cost of issuance/acquisition is dropping to 0. Banks have proven incompetent at creating a Visa/MA replacement. What are the levers in negotiation? How will merchants negotiate a lower rate?

The path in Europe, Australia and the US (Durbin/Debit) has been driven by regulation. No one likes having regulators define the rules, but my investment hypothesis is that there will be a very large TILT of Visa/MA toward the merchant. This will address the both regulatory pressure, and open up new revenue streams surrounding data (below). This tilt means moving rates in the direction that retailers want, creating new rate tiers where risk and identity can be managed by the merchant/platform. Remember Apple is getting 25 bps for their service, the next logical move would be make this same “discount” available to anyone that can drive down risk. Personal-Data-Ecosystem-Diagram-from-FTC-Roundtable

From an identity perspective, Google and Apple have authentication as the CORE feature of their mobile platforms.. it is key to everything they do in mobile. See my blogs on Brokering Identity Authentication in Value Nets, and Authentication – Key Battle for Monetizing Mobile for more here.

#2 Data and Commerce Value

The comments below are largely taken from my blog Banks, Non-Banks and Commerce Networks. As a side note, this is the focus of my new Company: CommerceSignals. We are working with the Fortune 50 to serve as the neutral broker, one layer above the network, supporting companies working together offline and in mobile.

Today, every issuer and card network is chasing after American Express and Alliance Data Systems. Both ADS and Amex have made SUBSTANTIAL progress in working with merchants to deliver new value to consumers. AMEX and ADS have the benefit of working in a 3 party model where they own both the merchant and the consumer relationship.  As I’ve stated before, I believe these 2 companies are 3-5 years ahead of everyone else. Is this data stuff delivering any revenue? Market Size AdvertisingFor ADS the answer is a resounding yes, for Amex the benefits seem to be less direct and more on customer loyalty/spend/engagement. See my blog on Amex Innovation Leader for more details.

Think about the battle in connecting networks, as each of us have limited resources we can connect only to a finite set of “hubs” (unless there is some larger orchestrator). Examples are Wikipedia and Google… these serve as the directories of information. It is almost IMPOSSIBLE to displace an efficient hub. This is why I love Visa, MA and Amex. If they can shake the issuer “tilt”.. and add a few merchant friendly services, they could leverage their networks in many new ways. The revenue opportunity? Payments in the US is roughly a $200B business (issuers, acquires, processors, networks), whereas marketing is $750B (in US).Infographic_Showrooming-lg

Payments work well, but so did the Sony Walkman. The bets that Google, Apple, Amazon, Facebook and others are making is on value orchestration. Does this involve payment? Not really.. at least not as a primary focus.. Payment is there.. but orchestration is about commerce; payment is just one of many important processes (See blog Payment in the OS).  Don’t look at payments as something in isolation, payments are the “connections” made in commerce; they are made for a purpose. Visa and MA also have the potential to expand their “traditional network”, but this must involve a separate agreement with separate rules.

Payments = Network

Here is my network view. Payments are the connections of the GDP. If we were to map payment flows, we would unlock a map of the global GDP at the micro level, from employment to shopping, behavior and preferences, to demand and supply. Free information flow on the internet is enabled through openness and a single primary protocol, whereas payments operate within 100s of proprietary networks with a complex series of clusters and “switches” (there is effort in connecting, authenticating and managing risk). Just as it would be nearly impossible to change the protocol for the internet, it would be difficult to bring fundamental change in payments (see Rewiring commerce).  Now think about the value of payment data. Connecting business is much different than connecting information (the core of CommerceSignals.. but I digress).

From a network strategy perspective, the business opportunity of changing “payments” pales in comparison to the opportunity to influence connections in commerce, banking and manufacturing. Payments support business and consumer needs; they do not alter their path. This insight is the downfall of bank payment strategies around “control”, and their inability to “tilt” toward merchant friendly value propositions.

A top 5 retailer provided my favorite commerce quote

“I think of Commerce as a highway, the payment networks are like a toll bridge. I don’t mind paying them $0.25 to cross the bridge, but they want to see what is in my truck and take 2-3% of what is inside. Hence I’m looking for another bridge… “

ADS, Amex, Google, Amazon, Facebook, Alibaba, V, MA all understand this. Rather than charging toll for crossing their bridge, these networks are beginning to execute against plans to grow the size of the goods in the merchant’s truck.

Existing networks have an existing value proposition, and many don’t like to have their services leveraged by competitors, thus there is a much more highly “regulated” flow of information. Intelligent use of data increases the effectiveness of networks in a way that also benefits consumers. Tilting more toward merchants and consumers.. means tilting away from banks. This is VERY hard for a bank to initiate. It is a change worth making however, as assisting merchants (or consumers) is what brokering is about. My firm belief is that both V and MA have the opportunity to grow Revenue 4x+ in the next 5-10 years. Their principal challenge is to “tilt” their models away from Banks and toward the 2 parties that matter most in commerce: Merchants and Consumers.

#3 Consumer Behavior/Trust/Acceptance

Perhaps nothing matters more in business than consumer behavior (see Consumer Behavior: Discerning and Capturing Value). In payments we learn over and over again that behavior changes slowly in 20 year cycles (Checks, Debit Cards, ATMs, Mobile). Any investor looking for payment innovation should run away unless there is some underlyibranch visitsng commerce value proposition. Payments work REALLY well its everything else that is broken (in OECD 20 countries)…. Among Payment innovators/founders there is a common saying.. you only start ONE payment company.

It is easiest to find the hotspots in payment by looking first for the changes in consumer behavior. For example, the tremendous change in how consumer’s are using their phones, as I outlined earlier this week in eCommerce/mCommerce Convergence.  The banking relationship is also changing, as customers visit branches less than 3 times per year, and the billions spent on huge buildings, huge vaults, sports sponsorships and brand names gives way to value.

Brand reputations for 2014 just came out last week (see Venture Beat), with Amazon, Apple, Google topping the list. How did these companies earn this reputation? Through consbank likabilityistent daily interaction delivering value in every interaction. Value delivery and interaction are my key metrics for assessing investment and focus; both are key measures of consumer behavior and trust. There are many strategies: whereas Google engages with the average consumer 10-50 times per day (winning in frequency and insight), Amazon has a lower interaction but a much greater impact on transaction (value delivery), Apple’s interaction is more holistic within a much more affluent base, Facebook’s is more social.

If I were to outline one KEY point to my bank friends it is this: you can’t reach consumers where you want them to be.. you must reach them where they are. This is the essence of why most bank strategies to engage are failing. Consumers choose to go to Google, Apple, Amazon because of the value and service. As the charts above show, most banks are challenged to deliver value within the core banking products they already delivery, why would any customer want to use a new service in this environment. Thus Bank’s efforts are ill suited to drive a deliver products outside of their core, and outside of existing consumer behavior, banks play a role in SUPPORTING commerce.. not leading it (see Card Linked Offers).Measure Data

Apple is the greatest company in the world in delivering value, experience and changing consumer behavior (see blog Apple and Physical Commerce, and Consumer Behavior). Apple’s reputation is well deserved and earned “the hard way” by remaking: phones, music, mice, computers, apps, …etc.  Through consistent delivery of value within fantastic hardware delivering great (and fun) consumer experiences they earned trust for their products and brand. The greatest NEW opportunity for Apple to influence consumers beyond the individual (music/contacts/calendar) and eCommerce (browser, apps) to the real world: Commerce.

Unfortunately Apple is inept at partnerships, even within its own supply chain. While apple has the talent to accomplish this, their commerce, payment and ad teams are buried within a hardware culture. They will only succeed if they are spun off into a separate division, thus my view is that there is a very low probability of Apple acting in an orchestration role across 1000s of Banks, millions of retailers and billions of consumers. If they did move, it my recommendation (and guess) is that it would be a consumer centric orchestration role as I outlined in Brokering Identity.

One technology (and behavior) I’m keeping an eye on is Beacons and mobile use in store (engagement). Qualcomm Retail Systems spun off the IP around Beacons to Gimbal with Qualcom and Apple both rumored to have 30-40% of the equity. Today Retailers are the entity best positioned to change consumer instore activity for 2 reasons: they alone know consumer product preferences, and they physically touch the consumer (trust, value, presence). See Retailers as Publishers , and Apple iBeacon Experience for more detail.greendot

#4 Issuance/Customer Acquisition/HCE

Now this is a mixed bag of topics. What is fundamentally changing in card issuance? Most of you know I ran remote channels at both Citi (06-07) and Wachovia (02-06). Today, most new customer bank accounts are originated online as branch visits go down and direct mail (the old way) even directs the consumer to this “instant” channel.

Historically I had to spend about $150 in marketing for every new card customer, and around $80 for every new deposit customer. Banks still incur roughly these same costs, but prepaid cards have an acquiring cost of less than a tenth of this cost (See Future of Retail Banking: Prepaid). In this pre-paid model banking products sit on a shelf in a retailer and compete for customers just like shampoo and candy bars.

I would challenge all card participants to think about the credit card product… what delivers value? what about it is unique? how do consumers view it? how is it part of a great consumer experience? When you leave Disney World do you think wow.. buying the ticket with my card was just fantastic? How are new customers acquired? Who benefits when cost of issuance is $0? Is charging the average consumer 12-16% on a card, paying them 0.2% on their savings charging merchant 2% a great model?  Do you think that there is room for improvement? Where do retailers win (ADS, Private Label, Co-Brand, )?

What prohibits you from having 20 retailer cards in your wallet today? Bank card issuers will roll their eyes, but you can not understate the influence that trusted retailers have in consumer decisions. Take this trust together with direct sales force and frequent consumer interaction and you have Private Label and industry whose cards outnumber everyone else’s by a factor of 2. As this week’s Morningstar article on Private Label shows, private label (the largest card segment) is making a tremendous comeback.Private label market share

Citi, GE (now Sychrony), ADS, HSBC are leaders in this space, with ADS advancing most in use of technology. Retailers like Nordstrom, Macy’s, Sears and Kohls are fanatical on their private label program, as their most valuable customers use this product. All new customer experience must first address this base, which you can see is one reason why we don’t see ApplePay being pushed here at all. As I described in Retail 101 (and What do Retailers want in Mobile), most retailers don’t know who their customers are today. Private label and Loyalty programs solve this problem.

Let me throw in a little tech now. I’m on the board of advisors of SimplyTapp, the company that created HCE. Instant issuance is key to everyone in the card space, why wouldn’t every retailer want to enable a private label card if card issuance cost is $0!? Credit worth customers can get store credit, sub-prime get decoupled debit (see Target Red Card) and everyone else gets a loyalty only? I believe we will see this happen, not only within MCX but within platforms like Google, with PL managers like ADS and Citi. This is the strategy focus of the top retailers… (focusing on their top customers).Private Label Profitability

My bet on the future of Google wallet is that it will be very merchant and consumer friendly, enabling them to uniquely integrate to 100s of merchant platforms to create great consumer experiences. This linking of PL, Loyalty, in store, maps, mobile, advertising is value orchestration.. but it all starts with consumer opt in. The opt in is both to merchant (private label/loyalty) and to Google. See blog Host Card Emulation for more background.  Google made the right technical move in HCE, but it dropped the ball in enabling merchants through last mile.. not a technical limitation .. an educational / awareness one.

Do I believe that the world will go private label!? No, it will be at the margins. My view of Visa and Mastercard have changed over the last 2 years. Before I was much keener on the development of a new scheme, but no more. Why? How many networks can you list where millions of participants have invested billions of dollars to make it work? Visa has 1.7B cards and 36M merchants.. how could anyone compete with this? This network works REALLY well, with the only issues with their network are in their control (merchant costs and rules).

#5 Regulatory

From a regulatory perspective, the US retail payment system has been impacted by the Durbin Amendment and the EU to an even greater extent by SEPA and PSD (see my blog).  Most of you have also read my token blogs outlining how the US banks were planning to build a new payment network to compete with V/MA (Now dead).  If someone has a info-graph picture of global acceptance rates I’ll put it in here.. but suffice to say that airline ticket pricing has NOTHING on the complexity of payment pricing.

Visa and Mastercard are largely insulated from the regulatory driven pricing changes, as the issuers continue to bare most of the impact. The EU has created a payment nightmare environment with “cross border” Credit card merchant interchange (MIF) at 30bps starting in later this week Jan 1, 2015 (see article and Visa’s response). The EU can not mandate change within country (domestic transactions), but there will be a race to the bottom in fees.

EU competition commissioner Margrethe Vestager claimed that interchange fees are a form of tax levied on retailers by banks and said that the new legislation would reduce those costs and “lead to lower prices and visibility of costs for consumers”.

Ms Vestager may be correct from a transparency perspective, but SEPA and the PSD put governments into the brokering role with no incentives for intermediaries to invest.. making payments a nearly free infrastructure service (with agreement of consumers and merchants). Network work best when there are shared incentives, and minimal regulation.  I believe Visa and Mastercard will work with new vigor to build relationships with merchants and deliver value, to head off the regulatory driven approach. Unfortunately Europe is already too far gone for this to work.

A prediction (next week’s blog) will be merchants providing greater influence in V/MA rules.

#6 Payments in the OS

My blog from this week: Payment in the OS

card-financial-compete view

Comments appreciated.

Perfect Authentication… A Nightmare?

This question is very similar to the story above on EMV. The engineer in me recoils at the thought that a sophisticated technology (which decreases risk), would not be welcomed within a market. To understand WHY, you must answer the question: WHO benefits from the risk reduction? If your business is risk management, and someone takes risk away, what is your business?

4 Nov 2013

Long blog.. load of typos

As I’ve stated before, this blog has been a great way to make new friends and stay in touch with my 100s of friends and former employees around the world. When you are in a small company you tend to lose touch with what else is going on as you no longer have 1000s of folks feeding you market intelligence. Small companies live and die by the risks they take, and I’m primarily focused on reducing risk by sharing G2 and perspective.worry-about-identity-theft-confession-ecard-someecards

Industry History (experts can skip this section)

I’m fortunate to have worked with some of the best teams in both Security and Fraud areas. Back in 1998 I ran Oracle’s Payment and Security National Practice where we did things like PKI, Single Sign On, as well as Oracle’s first Java application: iBill and Pay (built on Oracle’s first Application Server OAS which scaled to 40 users regardless of hardware). I switched from the tech side to the business side in 02, and can assure you that running online Banks keeps you in the security AND Fraud space. In 2008 I left Citibank to go to 41st Parameter (just acquired last month by Experian). 41st Parameter was founded by a visionary fraud prevention guy.. Ori Eisen, with a focus device ID.

From a Commercial/operational perspective there is always friction between the security teams and the Fraud/Operations teams. The security teams are always working to enhance security, the fraud and operations teams are always working to mop up the mess from any holes in security and create proactive processes by which they can stop it. As I said in my blog last week, if I let security guys have their way with authentication …. customer experience would be awful.. and no one would use online banking. Hence we have services like Risk Based Authentication, Honey Pots, Fraud Controls, …

This same Security vs. Fraud dynamic plays out in payments. From the 1970s to the 1990s banks had built their authorization infrastructure around tools like HNC’s Falcon to create rules based authorization, with daily tuning of rules based upon fraud. Today Banks continue to invest billions of dollars in fraud and risk infrastructure (see blog). The metaphor for competition here

If you are camping with your friends and a hungry bear comes to your campsite.. you don’t have to be faster than the bear.. you just have to be faster than at least one other camper.

Thus the rule of thumb: fraudsters always attack the easiest target. Big bank billion dollar fraud platforms thus drive fraud to smaller competitors. This enables the large banks with sophisticated controls to derive higher margins in payment products, which drives incremental investment.  This is one reason why large US banks are so resistant to EMV (it levels the playing field). Fraud numbers in the US are not well reported, the best data is from my friend in the UK (see UK Card Association).  Large US banks were not involved (or informed) of Visa/MA’s plans to mandate EMV. As one CEO told me personally “Tom .. to this DAY Visa has never come by my office to discuss EMV, I found out about it the same way you did.. in a PRESS RELEASE.. “ [Top 3 Issuer].

In the late 90s Banks were not prepared for Card Not Present (CNP) Transactions that came from eCommerce. Their fraud systems (ex HNC Falcon rules) were not tuned for this type of transaction. Actually, banks really didn’t care much here because 100% of fraud loss was borne by the merchant. The only Bank impact was helping the customer deal with fraud (and reissuing cards). Thus RETAILERs began investing in Fraud systems and 3rd Party specialists (GSI, CYBS, 41st P, Digital River, 2CO, PayPal, …) emerged to help manage fraud on behalf of retailers. LARGE retailers followed the same path as large banks, investing in custom fraud infrastructure (ie Amazon, Apple, Google, Airlines, …).

Banks thus ceded eCommerce risk management to 3rd parties until around 2003 where 3DSecure was developed (See Wiki. Implemented as VBV by Visa and MSC by Mastercard). Merchants were incented to adopt the scheme by a liability shift (to banks) and an interchange reduction of 5-10bps. Rollout of the scheme in Europe was a disaster (see UK Guardian). Banks now owned a mountain of new fraud losses (as 3DS technology was broken), with only ONE tool to address: Decline Transactions. See my 2010 blog and Schneier’s: Online Credit/Debit Card Security Failure

Mobile

Banks are determined to avoid their prior mistakes, in eCommerce risk/roles,  and take a leadership position in mobile (ie payments, risk, authentication, data, … ). I’ve detailed their efforts in:

Why is mobile so important to Banks?

#1 PRIMARY INTERACTIVE customer touchpoint. 10 years ago, how did you interact with your bank when you were away from home, work and a branch? The only interaction you had was a piece of plastic.  Mobile enables a new class of Services.. but ALL mobile services must add value. The rest of these priorities pale in comparison to consumer touch… Banks are thus experimenting on what they COULD DO with mobile to remake banking.

#2 Authentication. Confirming identity of consumer.

#3 Risk Management. Both gaining additional consumer insight, and enabling new levels of risk control based on this data.

#4 Remaking of Retail Banking (reducing cost to serve)

#5 Mobile Payment.

#6 Partnerships. Sales, Distribution

I’ve touched on #1 many times, but before I go to Authentication/Authorization/Risk, let me provide a brief recap of my many blogs covering the “other services”. As I outlined in Card Linked Offers, Banks don’t realize is that just because you CAN interact with the consumer doesn’t mean that the consumer WILL. You must actually deliver VALUE if you want to capture consumer TIME. Having run 2 of the largest online banks I know what customers do. Retail Customers log in 3 times a week, check their balance, pay a bill or two and log off (180 seconds later).  Bank CEOs.. I gave my recommendation on what you SHOULD be doing in my Bank NewCo blog.

Authentication – THE Lynch Pin

As I stated in Who do you Trust,

Google and Apple are working to secure their platforms, and assume the central trust role in authenticating the consumer. I’m much more interested in the Apple’s new developer APIs than I am in the fingerprint app. How will they begin to “lock down” applications, what new authentication features will they expose to developers? How will they allow consumers to provision sensitive data to other apps?NFC Change

Hardware is evolving to software (from NFC to the SIM). …[ If Google locks down Android with a new secure OS, they will be in a position to provision Google applications (Maps, mail, search, …), identities, and cloud based services (drive, Google Now, Commerce, …).  The “freeware” model could still exist, but without the cutting edge Google services it becomes a COMMODITY HARDWARE game.

What we will see at Money 2020, is that there is an all-out war going on for the Trust role: Banks (see Tokenization), MA/V, MNOs, Samsung, retailers… everyone realizes this is the “key” to unlocking future value in the convergence of the virtual and physical world.

and in Authentication – A Core Battle for Monetizing Mobile

As Ross Anderson said “if you solve for authentication.. everything else is just accounting”. Think of how much bank infrastructure is dedicated to authentication of the consumer and risk/fraud management. This infrastructure was built over last 30 years because there was VERY poor ability to authenticate a consumer (ex. signature and possession of card) AND inconsistent CONNECTIVITY at each commercial “node” touching the transaction. Today we have complete connectivity, but the MODEL has not evolved from its archaic past.

Beyond Authentication, mobile also plays SUBSTANTIALLY on the risk side, as it enables Banks to interact OVERTLY and COVERTLY with the customer. For example a risk system could ask: is the customer’s cell phone within 20 yards of their transaction (at X merchant).  Or even issue the customer a one-time PIN (or PIN request) to complete transaction.

Perfect Authentication – A threat to Banks?

This question is very similar to the story above on EMV. The engineer in me recoils at the thought that a sophisticated technology (which decreases risk), would not be welcomed within a market. To understand WHY, you must answer the question: WHO benefits from the risk reduction? If your business is risk management, and someone takes risk away, what is your business?

If we made an inventory of payment systems (technical investment) between merchant to consumer bank we would see today’s systems, processes and rules would be DESTROYED by a future state of connectivity and authentication. I’m sure this one line statement will be questioned “prove it”, but I don’t have time.. I’ll leave it to someone else. Take this statement for what it is: my opinion.

Authentication is 0-1, Risk and Fraud deal in shades of grey. For example, if there is a CHANCE that Joe Smith is a really a the end of the transaction, and he is my wealth customer, I’ll let him in the door, see what he wants to do and then risk it based on it. I certainly won’t LOCK HIM OUT.  Another example, if I could authenticate a customer why do I need to make the transaction secure? This is the BEAUTY of the Square “pay with your name” scenario.  Why do I need tokens? Someone just needs to map consumer ID to payment types.

The very concepts of payment “products” begins to dilute. No more credit, debit, pre-paid, Amex, ACH, check, … In a world of perfect Authentication “old line” products evolve toward dumb pipes as competition shifts to speed and cost (not risk).

From Cash Replacement

Networks are designed around a value proposition.  For payments to flourish, a coordinated system of instructions which can be read by trusted participants is necessary. Providers of payment services must consider what network participants are providing in order to collaborate in risk management and settlement; the greater the number of consumers and businesses that participate, the greater the collaboration and interdependency. As more people adopt the payment system, its value increases, since it provides access to more people; this encourages larger networks. Not only do the benefits increase as the network expands, but the per unit cost of service falls. This behavior is the basis for what economists refer to as a “network effect”.

Once a payment system reaches a “critical mass”, economic value will be created at the ends of networks. At the core- the point most distant from users-generic, scale-intensive functions will consolidate. At the periphery-the end closest to users-highly customized connections with customers will be made. This trend pertains not only to technological networks but to networks of banks as well as small merchants and even to consumers who engage in shared tasks9. From a payment network perspective, this means that the “routing” of payments will provide much less revenue opportunity than managing the end points (e.g. the customer interaction or the products which are sold on the network).

…] Payment networks are inherently “sticky” with investments required by consumers, merchants, and banks for effective functioning. Payment networks also have substantial government involvement to support Commerce and Treasury functions that ensure stability, resilience and protection of parties. Innovation in payments is challenged by this network dynamic. As most small companies know, getting a bank to make a decision is tough… but nothing compared to getting 4-6 groups (issuers, acquirers, merchants, MNOs, Regulators, networks, ..) to collaborate in making coordinated change. A level of difficulty that is only superseded by the challenge new entrants face in competing directly against these existing networks.

A truely jaw dropping piece of research was completed last month by philippon_newfig1NYU’s Thomas Philippon (  http://www.voxeu.org/article/where-wal-mart-when-we-need-it).

The cost of intermediation grows from 2% to 6% from 1870 to 1930. It shrinks to less than 4% in 1950, grows slowly to 5% in 1980, and then increases rapidly to almost 9% in 2010

In other words Payments and Banking are one of the few network businesses in the HISTORY OF MAN to grow less efficient (rail, telecom, energy, …). This is BY DESIGN as the orchestrators of banking have successfully created constructs to squeeze COMMERCE. Further demonstrating that existing payment networks are incapable of leading ANY FORM creative destruction. As I stated in Commerce Battlefield

Mobile is a platform which enables a radically improved customer experience. With respect to payments it also offers a unique ability to authenticate a consumer (fingerprint, GPS, cell tower location, voice, camera, …). Yet, no banks are looking to leverage these “new” capabilities in a “new” payment system. After all, given a clean sheet of paper, no one in their right mind would design a payment system like we have in Visa/MA: present a credential to a merchant, who passes to a processor, who passes to network and routes to issuer to approve a customer transaction… giving the auth to everyone in the chain again.. and getting back another message. If everything is connected why not just ask the consumer to send the money from their bank (ex Sofort,  Push Payments also read Banks will Win in Payment ).

Why? Well because Banks can’t make money in a Sofort model.. (would need to create all new merchant agreements). This is why Banks are going through contortions to stay within Visa/MA, yet attempting to alter it fundamentally (ie Tokens). … (Also see Push Payments)

Regulation… the KEY

Payments, telecom, commerce, customer data, … all are regulated (merchants … not so much). Banks are completely justified in seeking solutions to their current regulatory burden. After all they bear most of the AML, BSA, CPFB, FED, OCC, .. burdens here. What needs to happen is that regulators must allow non-bank entities to bear risk. This is where innovation occurs. See blog US Payment Innovation and Regulation

Authentication – A Core Battle for Monetizing Mobile

Those of you with more than 15 yrs in the industry will remember dedicated T1 lines that moved data in secure pipes from one location to another. We now have VPNs, transaction signing and encryption that allows for use of generic pipes between COMPANIES. Authentication at a USER LEVEL will now permit yet a finer grained LEVEL of Secure Services and Data ACROSS companies. Today we have Cloud services from Apple, Amazon, Google but how do you navigate amongst them? How can a Start Up develop services that SPAN them? Authentication and is Key…. And MNOs may be best placed to deliver this service.

16 October

I was delighted to see yesterday’s announcement on Verizon’s updated authentication efforts (UIIS), the American Banker Article pointed to a consumer focus,

“We want to be the world’s largest identity provider,” says Tracy Hulver, chief identity strategist at Verizon Enterprise Solutions.

I’ve always held this is a tremendous opportunity for MNOs given their distribution, ability to physically site and verify both consumer and phone, as well as their network management capability (ex. know where the device is). In fact one of my oldest blogs (4 years ago) laid out the high level opportunity.

What are some of its problems on web today? Junk mail, Spam, Phishing, Pharming, Trust, Fraud, Passwords everywhere, card numbers everywhere, consumer data/cookies, beacons, …  much of this is caused by ubiquitous anonymity. Consumers should have the right to be anonymous, after all I don’t give a physical store my ID when I walk in to shop.  But what if I wanted to be known?

Remember the early visions of “web services” A technical panacea where I could combine distributed processes from multiple providers acting on distributed data. Much of this never came to fruition because there was little trust, no service levels, and no way to distribute revenue.  Web service architecture took off fantastically within an organization… but corporate success required  resolving the issues above (as well as securing the pipes).

Those of you with more than 15 yrs in the industry will remember dedicated T1 lines that moved data in secure pipes from one location to another. We now have VPNs, transaction signing and encryption that allows for use of generic pipes between COMPANIES. Authentication at a USER LEVEL will now permit yet a finer grained LEVEL of Secure Services and Data ACROSS companies. Today we have Cloud services from Apple, Amazon, Google but how do you navigate amongst them? How can a Start Up develop services that SPAN them?  Authentication and is Key…. And MNOs may be best placed to deliver this service.

What problems could authentication (via mobile) “solve”?

#1 Payments – Of course this is the top of my list. My favorite quote from Ross Anderson “if you solve for authentication.. everything else is just accounting”. Think of how much bank infrastructure is dedicated to authentication of the consumer and risk/fraud management. This infrastructure was built over last 30 years because there was VERY poor ability to authenticate a consumer (ex. signature and possession of card) AND inconsistent CONNECTIVITY at each commercial “node” touching the transaction. Today we have complete connectivity, but the MODEL has not evolved from its archaic past. I could write a book on this topic alone. A key REQUIREMENT for authentication to IMPACT payments is that ALL ACTORS (Bank, Retailer, Regulators) must RECOGNIZE and TRUST the services of the AUTHENTICATION PROVIDER. I would love to see the Fed lead here in creating a certification process…

In a perfect world, the following happens

  1. Legislation to create requirement (by Banks) to: recognize independent authentication services which comply w/ Fed, clear authorized payments in under 24 hrs, absolve banks of compliance responsibilities for authenticated payments (if they don’t own authentication).
  2. Fed creates Payment Authentication certification, requires banks to keep Auth at transaction level and absolves banks from compliance issues for authenticated transactions (assuming authenticated party was NOT on an AML list).
  3. Banks adapt systems to comply, or Fed enables transactions directly in a new real time service (with integrated authentication per transaction).  This is what happens when international banks provide remote consumers wire transfer capabilities (as in James Bond)
  4. … 10 yrs later…

#2 Fraud. Medicare, Obamacare, Welfare, Pension, …  A phone with integrated biometrics could make a very significant dent in $80B of false claims (FBI estimate).

#3 Better Auth leads to DUMBER PIPES. Look at what happened to our economy the last time we had a generic network where anyone could build.  Better authentication will allow us to REWIRE COMMERCE… with the Banks as a primary loser (note I spelled it correctly today).

#4 New Services. A corollary to #3. Integrating cloud and data across providers and across platforms.  The realization of an early web services vision… Consumers could have control over provisioning and “orchestration” of their data. For example allowing health care data to be shared with doctor (for second opinion), or allowing merchant transaction data to be shared with Google or Proctor and Gamble for a fee.  The receiver must be able to trust both the consumer’s permission and the source (3rd party validation). … Possibilities are endless (and exciting).

#5 Digital Signatures. Applying and COMPLETING a loan application, college application, commitment to purchase, contracts, licenses. Enabling the US to catch up with Singapore on eGovernment, and making our lives easier. Improving the ability to open new accounts also increases competition as intuitions must compete for our business daily.

Other thoughts appreciates.

MasterCard follows Visa’s lead on EMV Push

Yesterday MA followed lead and announced plans to support US rollout of EMV. Many of you are probably wondering what this all means in light of mandates and deadlines. The politics and business drivers behind this push are quite complex, but the most important to note that neither large US issuers or retailers are enthused about this push as there is no business case for the change on either side.

31 January 2012

http://www.mastercard.us/mchip-emv.html

Yesterday MA followed lead and announced plans to support US rollout of EMV. Many of you are probably wondering what this all means in light of mandates and deadlines. The politics and business drivers behind this push are quite complex, but it is important to note that neither large US issuers nor retailers are enthused about this push for one primary reason: there is no business case for the change (on either side). Historically, networks do not change without sound financial incentives ( or there is some sort of regulatory mandate).

A Bank makes money by managing risk. Within the payments space large banks have invested billions of dollars in custom fraud infrastructure. The effect (if not the goal) of bank investment in custom fraud infrastructure is to push fraud into the weakest link (or bank) in the network. Smaller banks must seek partners like FIS, FirstData and the Networks to help them keep up. The EMV standard is used by card issuers in just about every market globally, except the US. EMV is effective in addressing certain kinds of fraud such as counterfeit and skimming. Within an EMV environment, international issuers and acquires thus could relax in maintaining related fraud controls IF cards existing in an EMV only environment.  However international travelers to the US and US travelers abroad lead to fraud “leakage”. US issuers did not suffer, due to their fraud infrastructure, but the other banks have.

Thus the “true” benefits of EMV cannot occur until there is 100% adoption at POS (10M in US), complete elimination of the mag stripe in the plastic that we all carry (approximately 1.5 billion in US). This is the conundrum facing any new technology here:  New Plastic must completely replace the old. In other words there is no “Incremental” fraud savings to an incremental rollout, nor is there a business case for either issuer or retailer to implement. Take this on top of the fact the EMV is 20 year old technology and we have a very challenging environment.

What are the benefits in retail? Both Visa and MA have established a carrot and stick approach. Given only the issuer can reduce interchange, the carrot is reduced PCI compliance costs and some terminal subsidy. The stick is a liability shift for to the merchant  if a consumer presents an EMV capable card and the merchant terminal does not accept it.  Given that the big issuers have no plans to reissue cards, the merchant risk is fraudulent EMV cards (starting in Oct 2015 for Visa). Perhaps if retailers see an EMV card, they should request an ID.  For issuers, the compliance dates are longer and the stick which Visa and MA have constructed is weaker given that US issuers already bear costs of card present fraud.

So what are Visa and Mastercard trying to accomplish? From a political standpoint they must address the international issuer concerns and be viewed as supportive of the EMV standard. But more importantly Visa and MA want to cement their control of the network, particularly in two areas: mobile and US debit cards. In mobile, Visa and Mastercard are aggressively trying to make mobile POS payments a “premium” service used exclusively by credit cards. A key to success in mobile is POS readiness to support contactless payment. The EMV mandate certainly helps provide another incentive to merchants. With respect to the Debit, the Durbin Amendment has impacted the incentives for US banks to continue support of Signature Debit. In the US, PIN Debit enjoys a slightly higher growth rate (15.6% vs 14.3%), consumer preference (48% vs 34%), lower fraud rate (2009: Signature $1.12B, $181M PIN debit card),  and obvious merchant preferences (96% of PIN fraud losses assumed by issuers, vs 56% in Signature). PIN debit transactions do not need to be routed through Visa and MA, and PIN only cards do not require their logo. EMV debit cards may be a tool for Visa to maintain a US debit business (MA US debit penetration is low).

What to expect?

Note that in virtually every geography, EMV was a regulatory driven initiative. In the US this is not the case, as the large banks have proven capable of managing fraud. Large issuers are thus reluctant to undertake any mass reissuance of cards, and US regulators are reluctant to have US Banks pay for a system that will primarily benefit issuers outside of the US. My guess is that we will start to see a trickle of new cards being issued on EMV starting in 2014 or so.

Retailers will have a similar adoption dynamic as they assess cards being used at their stores, and what future payment networks may offer not only in terms of compliance and interchange, but also in delivering customers through incentives and advertising.  I’m certain that the retail “first movers” in NFC must be pulling their hair out as they discover that their new NFC payment terminals are not equipped to accept the mandated EMV card. These retail CEOs will discover that the “stutter” in reterminalization was intentional and it will be a cost they will bear twice in 2 years.

In this dynamic environment, there will be high demand for companies that can help retailers develop a plan and navigate this chaotic environment. Oddly enough, start ups like Square and Payfone may have a tremendous advantage in simplifying the checkout process. In other words, EMV could actually provide the impetus for new payment networks to gain a foothold.

Mobile Swipe: Risk is Behavior … not Security

There is no single solution for all of this fraud, it is a constant battle and weapons just continue to improve and evolve on both sides. For banks, there are 2 common elements to all fraud strategies: educating customers, and security of customer data. In the US, consumers are quite fortunate to have the risks associated with fraud completely borne by banks (Reg E/Z). Outside of the US if you have fraud on your credit card it is your job to prove it. Hence a UK consumer is much less likely to give their card to just anyone, which is why the waiter stands at your table with a mobile card reader for you to enter your PIN.. your card is never out of your sight.

11 March 2011

I’ve been rather unambiguous in my views on Square. Yesterday I received a number of calls from my card friends, with over 50% in support of Square. After pondering their feedback, my bigger concern is customer behavior… a concern that expands beyond Square to all swipe based mobile payments (although I still feel quite strongly that they are not playing by the rules that everyone else agreed to).

For background, beyond my role as alternate channels head for Citi (Outside of the US), I also led sales and marketing for a little start up backed by Kleiner Perkins (41st Parameter) that focused on fraud. Through this role, I was fortunate to develop relationships with the fraud heads of every major US and UK bank and card network. Truly fantastic people… think of them as a mixture of James Bond, CSI, and Elliott Ness (Famous FBI guy). To be honest, I never saw these fraud teams during my time as a banker, and never really appreciated their role in keeping the banking system safe.

Frank Abagnale (of Catch me if you can) was on 41st’s Advisory Board. 40 years ago, this was the kind of fraudster that the bank’s team had to track down.. one guy in a garage with a printing press (magnetic ink). Today, the nature of fraud has changed tremendously. Well organized rings are flourishing, one of which has over 500 employees with product, engineering, marketing, sales…. a specialization of labor. Phishing was a great success, as customers responded to e-mails looking legit. Banks responded with improved online security. Fraud rings responded with malware and “man in the middle” attacks.. point is that this is a dynamic war taking place and bank fraud teams are the “special forces” that crack the code.  The online fraud environment is the most complex battlefield of all. 

It takes resources to win any battle. To give you an idea of the size of risk, gross fraud (attempted) at PayPal was around $500M dollars last year. Through technology and people, PayPal reduced that number to under $50. Bank margin is driven by the ability to manage risk; this is the nature of banking. The top banks, Paypal, Amazon and Apple all have world class teams and resources in this area… thus they seek both higher margin (ie risk) and volume. In essence they “compete” by managing risk more effectively than their peers. A well known axiom applies: If a hungry bear comes into your campsite, you don’t have to be faster than the bear.. just faster than all of the other campers.

There is no single solution for all of this fraud, it is a constant battle and weapons just continue to improve and evolve on both sides. For banks, there are 2 common elements to all fraud strategies: educating customers, and security of customer data. In the US, consumers are quite fortunate to have the risks associated with fraud completely borne by banks (Reg E/Z). Outside of the US if you have fraud on your credit card it is your job to prove it. Hence a UK consumer is much less likely to give their card to just anyone, which is why the waiter stands at your table with a mobile card reader for you to enter your PIN.. your card is never out of your sight.

Example story from yesterday.

Groups of brilliant fraudsters created small mini kiosks called “card cleaners” and placed them in ATM booths, grocery stores, vending machines.. “Clean your credit cards for free”..  I’m not making this up.. people really used them. The crooks just took the numbers and sent them to Algeria (a favorite destination) to create new cards, or to sell to other organized rings. The rest of world hates US use of magstripe.. we are the only country in the world that has not adopted the EMV standard (aka chip and PIN). EU readers still take mag stripe because of the US tourist dollars..

These fraudsters were successful with just magstripe. What if they had your name, e-mail, phone number, … ? If you went to the grocery store, and the clerk asked you for name and phone number and put it in her phone prior to authorizing your transaction would you provide it? This is exactly what Square is doing. Read Dorsey’s response to Verifone’s security concerns. Giving merchants additional data will not decrease fraud, but establish new patterns of customer behavior which will increase it for all. We have a “battle” within the banks today: The card business want to grow transaction volume. The fraud organizations want to protect customer information and ensure customers don’t give their data out to just any hot dog vendor on the street.

Future Scenario

A good crook would probably spend a few days developing an iPhone app that swiped your card, asked for your PIN, took a picture of the back of your card (w/ CVV), obtain phone number and e-mail address. A fraud ring sets up hot dog or ice cream stands (that only take cards) with $0.50 ice cream… they would never even use Square’s software.. or even try to submit a transactions. They would give the food away for free just to get the data.  Once I have this data, I could send within seconds to my HQ to commit ATM, online or even POS fraud in any number of countries.

Was Square’s technology any part of this? Nope.. people could do this today. Is Square encouraging a sustainable consumer behavior? Nope. Smart merchants (Apple, PayPal, …) are choosing Verifone PayWare Mobile because the device is secure.. your employees can’t put on a skimming app because the data is encrypted when it enters the phone. But do I want my bank customers examining the make and model of the card reader before they turn over there card? Heck no! So what do I tell my bank customers? Only give your cards out to merchants you can trust? Do banks incent proper consumer behavior on card use? No.  You get the picture… life just got much more difficult for the fraud and customer experience teams.

Individual issuers have the power to decline square transactions. My guess is that at least 2 major banks will begin to decline all square transactions within next month. Beyond the fraud risk, it also competes with their own mobile initiatives (Barclays/ISIS, Mastercard/RIM, …).

NFC is a step beyond EMV in security… subject for another blog.

Comments appreciated.

Verifone Builds Square Fraud App in 1 hour

Verifone’s CEO (Doug Bergeron) published an open letter to the industry on Square’s flaw. The Square doggle is not PCI compliant (see my blog from last year). Verifone is spot on… they built this skimming application in ONE HOUR.

I took a look at my blog stats today… and they went through the roof.

Verifone’s CEO (Doug Bergeron) published an open letter to the industry on Square’s flaw. The Square doggle is not PCI compliant (see my blog from last year). Verifone is spot on… they built this skimming application in ONE HOUR.

YouTube Video just pulled.. . you can still view at http://www.sq-skim.com/

Chase Paymenttech is Square’s acquirer, and I spoke to them specifically about the Square risks last year. This is an industry issue.. as stolen cards and fraud generate both issuer losses (card present transaction) and a tremendous hassle for customers. I don’t understand why Chase supported this thing… Was told last week that Square’s fraud is off the charts. As I said back in 16 month ago in January 2010

The acquirer that takes this on will likely have a few headaches when the first major craigslist merchant starts using the device to skim and resell card information (among other things). There is a reason for PCI compliance and for my “securing” my physical card and CVV. I can’t wait to see Square’s Payment Services Agreement (PSA). Operationally, the issuer’s have control over card authorization through systems like HNC’s Falcon or SAS Raptor. This means that if SquareUp is found to have contributed to a data loss, or has a high number of fraudulent transactions (see link) customer would see their card transaction declined, or the network (Visa/MC) would shut SquareUp down.

The great thing about the PayPal model is that the customer funded the account after agreeing to terms. In Square’s model, consumers are unregistered, Square is acting as an agent of the merchant. For Square’s investors, there is atypical risk which they will see through “unique” bonding/insurance requirements from the acquirer.  Just as with any company, Square will face unlimited liability associated with loss of consumer information (think TJX). To get an idea for potential mis-use see you tube video below.. crooks invest quite a bit in technology here… will SquareUp make it easier for every iPhone owner to become a skimmer?

Update Thurs Mar 10

Networks are dependent upon everyone following the same rules. Rules are what make networks work, and are essential in “trusting” the transactions coming in. PCI rules were agreed to by all.. Square’s reader does not comply, nor does its iPhone app.  That said we have a very mixed bag of incentives within the current card networks. Banks and the networks want Square to succeed, as it will drive more transaction volume AND drive card use further down market with small merchants… see Visa’s blog

http://blog.visa.com/2011/02/14/emerging-payment-types-new-opportunities/

Bank margin is driven by the ability to manage risk. This is the nature of banking. Within credit card, Big banks like Chase have tremendous experience in fraud and risk.. they the seek both higher margin and volume.  Chase is comfortable with the risk it is enabling with square as both issuer and acquirer. However, their acquisition relationship with Square (through PaymentTech) enables fraud to enter the network, and other banks may have not updated their authorization rules to accomodate. For Example, Bank of America certainly wants increase transaction volume .. but is it willing to pay the price of  BOTH fraud loss AND of encouraging a change in customer behavior (give their cards to anyone with an iPhone and card reader)?

From my background at 41st Parameter, I was fortunate to develop relationships with the fraud heads of every major US and UK bank and card network. This will be an active discussion for them today. Bank decisions are caught up in the business dilemea of how to respond to Durbin, as well as their own mobile strategies and EMV perspective. Fraud usually develops once critical mass is reached, as fraudsters don’t want to waste their own resources developing a compromise unless there is volume.  My view is that Square’s reader and iPhone application are clearly not compliant with PCI rules and that Visa and Mastercard must shut them down. They have no choice.

Perhaps a story is in order to talk about potential impact. Groups of brilliant fraudsters created small mini kiosks called “card cleaners” and placed them in ATM booths, grocery stores, vending machines.. “Clean your credit cards for free”..  I’m not making this up.. people really used them. The crooks just took the numbers and sent them to Algeria (a favorite destination) to create new cards, or to sell to other organized rings. The rest of world hates US use of magstripe.. we are the only country in the world that has not adopted the EMV standard (aka chip and PIN). EU readers still take mag stripe because of the US tourist dollars.. and claim that we are responsible for their fraud (they have a decent case).  Verifone’s 1 hour fraud app (www.sq-skim.com) is not a technology issue as much as a behavior one. A good crook would probably spend a few days developing an iPhone app that asked for your PIN…. and took a picture of the back of your card w/ CVV, I noticed in Square’s response that they also ask customers for phone number and e-mail address (normally). This data is beyond the wildest dreams of fraud organizations.  I can just imagine a fraud ring setting up hot dog or ice cream stands that only take cards.. .and sell the ice cream for $.50… they would never even use square’s software.. or even try to submit a transactions. They would give the food away for free just to get the data.

As a side note Square is not winning against Verifone. Square has only 5k-10k active merchants (see blog) and $200k in revenue per MONTH… so lets stop this thing before it gets viral.

Square Up update

Square looks to be sitting on about 5k-15k customers and is in a holding pattern until they resolve fraud and risk issues

11 Dec 2010 (updated)

Previous post http://finventures.wordpress.com/2010/03/02/squareup-take-4/

Today’s Telegraph (UK)

Dorsey is a marketing machine! It’s just amazing how much buzz he has been able to create (yes I am envious). The Square application is stellar from a customer experience perspective. Although appshopper shows them in the top 20 free finance apps (~1M downloads), I estimate they are sitting on only 5k-15k active customers (this is the nature of a “free” app).  It also seems that they are in a holding pattern until they resolve fraud and risk issues (I covered this in last blog). From their FAQ

Until recently, Square was facing a big hardware shortage, but that’s now coming to a resolution. The problem has transitioned to something we’ve been working on simultaneously, a credit processing and risk issue: we need to strengthen our underwriting infrastructure so that we can handle the huge demand for readers and still manage the risk of chargebacks and fraud. This is the last thing preventing us from shipping readers as fast as we’d like, and we have almost the entire team working on it. We look forward to sending you a Square!

My guess on the hold up? iPhone cannot be made PCI compliant without first encrypting the card BEFORE it gets into the iPhone (see the Verifone solution). As you can see from the Visa PCI DSS list, Square is certified in 3 areas:

  •  IPSP (E-commerce)
  • Payment Gateway
  • Process Magnetic-Stripe Transactions

 This means that Square’s data center is approved to handle card data in these areas (ex. not leaving card numbers sitting around unencrypted). This does NOT mean that the Square Application or Doggle have been certified. In fact, a search in the PCI org’s list of approved applications has no mention of Square. Where Verifone’s Payware is shown approved (below).

This is certainly a driver for PayPal’s recent partnership with Verifone to enable PayPal to act as merchant acquirer (see Verifone Press Release)

My (somewhat educated) guess is that Square must redesign the “Square” for encryption AND its Application AND get it certified by the issuers. This is a 12-18 mo process … as I said last year.  Of course I could be wrong on this.. perhaps they are indeed near certification. Assuming they do get the US mag stripe issues resolves it will not translate into any global adoption. I laughed quite a bit after reading the UK Telegraph article.. particularly given the EMV (Chip and PIN) requirements in EVERY country outside of the US.  So a new “redesigned” Square for magstripe won’t work in europe.. that is yet another design challenge with its own certification process. Who said payments was easy?

The card networks and issuers want Square to be successful, as increased card acceptance means increased payment volume. But there is a reason that acquirers and merchant agreements exist. Fraud usually is 18mo-2 years behind a new payment method as its not worth the fraudsters time (and resource) to invent a compromise. Square will face unique risks not seen before by any acquirer. For example:  merchants accounts denied by other acquirers, physical card fraud rings, skimmers looking to take the cards and auth codes for use off line, virtual card fraud rings looking to “pump” card data through 100s of easy to set up Square accounts.

Square has a use, but the market is small. I expect many small merchants to give the service a try, but once they realize that it takes 30-60 days to settle and that they have a new burden (under reg z) for returns and consumer transaction dispute (ex reserves) they will decide that the headache is not worth it.  In other words they will face the same barriers that the large acquirers have in moving down market.  Dorsey was in a WSJ video yesterday outlining potential benefits for issuers using square. This is a soft repositioning of his company for a potential exit. He knows that the market is limited and is hoping for alliance plays with large issuers/acquirers. Banks are certainly in a better position to roll this out.. particularly because of their ability to manage card risk (but customer support is a “little” more robust as well). As I stated previously, smart money would wait for Dorsey to gain adoption and struggle through the issues before investing.

The problem that Dorsey is trying to solve is core to the acquiring business: how to grow card use among small merchants. Question remains on whether this is this a “technology problem”, or a business problem? For banks wanting to dip their toes in the technology: it is already available through teams like Verifone. For Small Merchants with a need for a convenient easy to use method for accepting cards:  go to www.paywaremobile.com and sign up with FirstData. For consumers: think twice about giving your card to the hot dog vendor..   banks own the risk (in the US), but there is still a big hastle in shutting down your account.

As I stated in my Jan 2010 blog, Square presents a risk to the payment system

The acquirer that takes this on will likely have a few headaches when the first major craigslist merchant starts using the device to skim and resell card information (among other things). There is a reason for PCI compliance and for my “securing” my physical card and CVV. I can’t wait to see Square’s Payment Services Agreement (PSA). Operationally, the issuer’s have control over card authorization through systems like HNC’s Falcon or SAS Raptor. This means that if SquareUp is found to have contributed to a data loss, or has a high number of fraudulent transactions (see link) customer would see their card transaction declined, or the network (Visa/MC) would shut SquareUp down.

The great thing about the PayPal model is that the customer funded the account after agreeing to terms. In Square’s model, consumers are unregistered, Square is acting as an agent of the merchant. For Square’s investors, there is atypical risk which they will see through “unique” bonding/insurance requirements from the acquirer.  Just as with any company, Square will face unlimited liability associated with loss of consumer information (think TJX). To get an idea for potential mis-use see you tube video below.. crooks invest quite a bit in technology here… will SquareUp make it easier for every iPhone owner to become a skimmer?

[youtube=http://www.youtube.com/watch?v=svzZxB0o8J8]

Visa Acquires CyberSource for $2B

Cybersource will provide Visa with an enhanced portfolio of services which could address merchant needs, particularly in risk, compliance, payment/fraud operations. However the expansion of Visa into these services poses a substantial risk to its business model as it runs the risk of alienating acquiring banks and other processors. Currently, I would view that risk as small because of the tremendous issues associated with online (eCommerce) payment system integrity and fraud.

22 April 2010

CYBS/Visa Presentation

CYBS 2009 10K

126x earnings? $3M/employee  Why? Did  Carl Pascarella (former Visa CEO added to  CyberSource Board of Directors on March 5, 2009) intend to drive this when he joined the CYBS BOD?

Part of the job of any payment network is to ensure a balance between network efficacy, profitability, risk and “value” received by each participant. (http://en.wikipedia.org/wiki/Network_effect)

CyberSource bills itself as the “The World’s First eCommerce Payment Management Company” and initially focused on enabling “bricks and mortar” retailers expansion into the online channel. CYBS has evolved to provide global turn key services to any retailer selling goods online… from payment to distribution (ex. Digital software).

CYBS 1009 10K

Our customers range in size from small sole proprietorships to some of the world’s largest corporations and institutions. Our customer base includes leading companies such as Air France, Borders Group, British Airways, Christian Dior, Eastman Kodak, Home Depot, Louis Vuitton, Massachusetts Institute of Technology, Microsoft, Nike, Starbucks, and Yahoo!, among thousands of others. To properly serve this diverse set of needs, we divide our potential market into two customer profiles, enterprise and small business merchants, which require different solutions.

Enterprise merchants have high sales volumes and generally demand the greatest range of payment options and the most sophisticated risk and management tools. These customers often sell in multiple countries and require support for local currencies and local payment options. Enterprise merchants also frequently need to integrate payment processing with one or more internal business systems. We serve enterprise customers by providing solutions that address and simplify the breadth of these requirements.

Small business merchants generally seek simplicity and ease of use. We serve small business merchants by providing bundled services and integrations into popular online shopping cart software, while bringing to the small business market some of the advantages of our enterprise-level services, including important new payment options such as electronic checks, as well as high-reliability and quality customer support.

Retailers face huge hurdles in building teams capable of navigating the complex rules and regulations associated with processing payments from PCI, Sepa, CARD, Reg E, Reg Z, … etc.  The very existence of CYBS (and competitors below) show the market for value added services as a precondition to Visa’s goal of: EXPANDING THE NETWORK.

We face competition from merchant acquirers, independent sales organizations, and payment processors such as Chase Paymentech, First Data Corporation, and Royal Bank of Scotland. We also face competition from transaction service providers such as PayPal and Retail Decisions, as well as eCommerce providers such as Accertify, Inc., Digital River and GSI Commerce Inc. Furthermore, other companies, including financial services and credit companies may enter the market and provide competing services. Another source of competition comes from businesses that develop their own internal, custom-made systems. Such businesses typically make large initial investments to develop custom-made systems and therefore, may be less likely to adopt outside services or vendor-developed online commerce transaction processing software.

Cybersource will provide Visa with an enhanced portfolio of services which could address merchant needs, particularly in risk, compliance, payment/fraud operations. However the expansion of Visa into these services poses a substantial risk to its business model as it runs the risk of alienating acquiring banks and other processors. Currently, I would view that risk as small because of the tremendous issues associated with online (eCommerce/mCommerce) payment system integrity and fraud.

This is a bold move by Visa to drive network expansion, in mCommerce and eCommerce, and expanding value added services which cover ownership of payment risk and operations. The price does seem high if we view integration without synergies (CYBS will have to run at a 45% CAGR to be accretive in a 10 yr horizon). Therefore, Visa’s business case must be driven by new services which can be offered in the short term to all merchants and acquirers (ex Fraud data sharing, digital goods distribution, …).

Can Visa grow this business more effectively under the Visa brand? Absolutely, but expect other network participants (issuers, acquirers, processors) to pressure Visa into managing CYBS as a separate entity. It is important to note that there is no love loss between most merchants and Visa. To address this, Visa should lead with a road show on how it will deliver value. Example.. it will take on fraud loss responsibility, improve marketing and take on compliance risk.

Tangentially, I believe Visa will also likely add significant $$ to merchant marketing programs. Visa is investing heavily in a new mobile marketing/advertising engine... that will sit on the Visa switch. Their existing merchant agreements do not handle this kind of “marketing” services agreement so they needed a new contract vehicle. Given CYBS’s merchant footprint, they now have vehicle which can be leveraged to expand the advertising business in a turn key model which also tracks fraud and fulfillment.