Benefits of closed-loop payment networks

I was surprised to note the continual downward trend of fraud figures reported by PayPal (see graph [includes some interpolation]), including their recent figures of 0.18%, which is about 1/3rd less than comparable figures with Visa/MC.  This is one of the obvious value-adds of closed-loop payment schemes.  PayPal is an example of a [dominantly] closed-loop scheme, in which the merchant and the consumer use PayPal for payment, thereby making it easier for the scheme provider to detect fraud.

Engines powering disruptive innovations in Payments industry

As I get to look at the payment card economics for online retailers in the US and elsewhere in the world, a couple of things jump out

• Merchant Discount Rates (MDR) are higher in the US (about 1%)
  
• Fraud rates are higher in the US (about 1%)
  

Even though online retailers are picking up the costs associated with online fraud, online retailers still pay a higher MDR.  A double whammy.

What stumps me is the basis for higher online fraud rates in the US.  In the online world, payment cards are all magstripe cards (you can't use chip-n-PIN cards onine).  Therefore, the US being a straggler in adoption of smartcard-based payment cards does not hold.  US prides itself on having a lot of intelligence in the payment network to detect fraud.  In spite of this, the US has $4 billion in online fraud.

Are the above indicators part of the landscape which can't be changed, or are the above indicators indicative of staid incumbents with little incentive to change status quo?  If it is the latter, we must be able to see evidence on innovations from challengers.

PayPal has been a disruptive innovator.  Though the MDR charged by PayPal is about the same as what the rest of the industry charges, PayPal's merchants have immunity from chargebacks (a 1% saving to merchants).  The fraud levels (transaction losses) experienced by PayPal is about 30bps (100bps = 1%).  A 1% premium MDR charged by PayPal while experiencing only 30bps of losses is a good business model.  So here we have a disruptive innovator offering a true win-win offering.  The online retailer saves 1% in chargeback costs, which is about 20% increase in net margins.  PayPal gets a 1% premium MDR while managing losses at 30bps (resulting in 70bps larger margins).

PayPal has been and expected to grow at about 18-20% CAGR while the incumbents are growing at half the rate (around 9%), which is proof of the relevance of the disruptive innovation of PayPal.

This posted started off evaluating the [possible] uniqueness of the US online payments industry, but is ending up looking at how a challenger is disruptively innovating at the cost of staid incumbents.  Please look forward to a follow-up post which examines why PayPal is an anomaly in the world of payments systems.

If the US does not go down the EMV road...

The debate over whether US should deploy EMV infrastructure or not has been intensifying of late. Some estimate the cost of deploying EMV in the US at $30B. Ms Baxley, retail payments management consultant, observed that Javelin Strategy estimates US EMV transition at a lower $5.5B. She also noted that, in lieu of EMV, leveraging contactless cards and readers [presently being deployed in the US] would adequately meet the payment card security needs while costing significantly less (even lesser than Javelin's estimates). As you might recall, contactless infrastructure being deployed in the US is based on Mag Stripe Data (MSD) fortified with dynamic CVx (in effect making a payment card number a one-time use card number). Please note that in this post, when I refer to US contactless cards/readers, I am referring to MSD with dynamic CVx (dCVx)

Debating card security aspects between EMV and US Contactless is an enticing topic, which can be set aside for another day and another blog.

Assuming that the US heads down the Contactlesspath (a significant leap of faith) as a means to enhance security of payment cards, let us look at the implications to the card payment infrastructure by fast forwarding to 2015 when US has transitioned to the brave new world.

• Cards: Cards would have to support both EMV applet and Contactless applets. Obviously, the cards would have to support both contact and contactless interfaces. Would we still need support for mag stripe on cards, for those still in the 20th century?
• POS infrastructure: Contactless readers supporting both US implementation and the EMV implementation would be necessary. Would US merchants need to offer support for EMV contact feature? Would ROW (Rest of the World) merchants need to support US contactless feature?
• Who is going to pay for retrofitting the global POS infrastructure to support both EMV and US Contactless.
• User Education: ROW consumers will have been educated (hundreds of millions of dollars of expense) of how and where to use contact EMV contact and contactless cards. It would be a very interesting consumer education experience and an expensive customer support issue of educating consumers, when they travel, about when and where contact cards are acceptable.
  

When you look at this picture, don't you long for the good-old-days of magnetic stripe cards, when one size fit all.

One of the lessons emerging from EMV deployments in Europe is that legacy support features (mag stripe on EMV cards) opens a large back door for fraudsters to take advantage of. As EMV cards reduced mail non-receipt, lost/stolen card, and counterfeit card fraud, online fraud and fraud abroad ballooned up. Card Issuers migrating to EMV were hoping for for 30% annual reduction in fraud, but realized only 10% reductions (APACS data), thereby significantly reducing ROI.

There are no silver bullets. However these are things that keep us awake at night.

As we look at the emerging economies of the world, payments card security is not a bottom-line issue (reducing fraud) but a top-line issue which communicates trust and security thereby bringing in large sections of population into the non-cash payments world, thereby growing the pie for all.

Where do you think that the payment card industry needs to be in the G-20 countries by 2015?

Incentives and rewards for secure online payments

Paypal plugin, and one-time credit card numbers are some of the innovations taking place in the online commerce space which are helping the consumer tackle online fraud.

One-time credit card numbers address the online fraud associated with phishing (malware capturing the card details as it goes across). Many card issuers / banks offer one-time credit card numbers on their sites. Paypal plugin, addresses threats from keyloggers. Citi offers similar plugins. Products, such as, Roboform offer similar security features.

I am wondering whether the fraud mitigation features used by a consumer (in association with the issuer) can result in lower interchange discount rates for the entity bearing fraud risk (merchant or issuer). The lower interchange rates received can be translated into loyalty points or similar benefits to the consumer. This would provide the right incentives for the ecosystem to take innovations around anti-fraud to the next level.

Presently, there are few incentives to encourage use of secure online payment solutions by the consumer. Interchange rates are broadly broken up into Card Present rates and Card Not Present rates. I am wondering whether there is scope for something in between the two. I understand that there already a myriad of interchange rates and are very confusing. My suggestion would only add to this 'mess'.

There may be a precedent, with Visa providing better interchange rates (a few basis points) for merchants offering VbV (Verified by Visa) on their sites. Would it be possible for similar to get similar incentives for using one-time credit numbers, secure plugins, updated browsers with the latest security patches...

What are your thoughts on how to motivate and reward safe online payment behavior?

Online Fraud Double Whammy

I am sure that you have heard about the startling discovery that a malware (Sinowal Trojan) has been harvesting financial data, including credit card numbers for nearly three years. The cache of stolen data exceeds half million records reports RSA FraudAction Research Lab.

On a related note, The New York Times reports

Microsoft plans to report on Monday that the security of its Windows operating system has significantly improved, while at the same time the threat of computer viruses, frauds and other online scourges has become much more serious.

News like the above are bad news for the online commerce industry. Especially, given the current mood of the consumer and economic environment. Improvements in technology can be leveraged to minimize the ability of fraudsters to profit from data collected by crimeware/malware.

A variety of participants, including CyberSource, Iovation, 41st Parameter have been working on combating this kind of fraud. However, what is becoming clear is that the fraudsters are a lot savvier and that we need to approach this problem very differently.

Call to action: Support the below technologies (some of which are already deployed for offline transactions) for online commerce transactions:

1. Support one-time credit card number, such as those offered by MasterCard in association with Orbiscom
2. Support use of dynamic CVx (CVV / CVC...)
3. Support multi-factor authentication, including utilizing CVM (Card holder verification) methods that are part of the current MasterCard and Visa specifications
   

The above advances will make the stolen information unusable. As credit card issue cycle is on average three years, the higher security cards will make it to the hands of the consumer over the course of the normal card replacement cycle. The cost differential of the higher security card will be made up by issuers if the consumer makes one additional transaction because of the higher security card.

Would love to hear about innovations that you are working on or are aware of that would remove the profitability from stolen data.