US Proximity mobile payments round the corner

The standard refrain around mobile commerce commercial deployments [in the US] is:

• Far East (Japan, Korea, Hong Kong) has been doing this for years. The rest of the world can use this roadmap
  
• Western Europe and US are more competitive/freer markets (as opposed to a handful of dominant players in Japan/Korea), and therefore, have to chart their own course (implying Far East's success is not readily transferable)
  

Business model (the 800# gorilla in the room) aside, I take a whack at understanding what Japan has done and what the 'western' world can learn from it:

Japan 2008-09 (tipping point?): 25% of POS terminals support contactless (400K out of 2.1 million); 40 million of the 90 million mobile phones have contactless / proximity payment capabilities; 780 Million payment cards, 80 million contactless cards, 10 million mobile electronic wallets enabled for contactless payments. Additionally, keep in mind, transit is an intrinsic part of life in Japan where majority of the urban population uses contactless technology.

US retail market: 8 million POS terminals deployed out of which less than 800K have contactless readers; 900 million payment cards in circulation, 400 million cards active, 80 million contactless cards. Needless to say, no phones, mobile wallets... (for proximity payments).

When will the US reach tipping point: Contactless cards getting into wallets of consumers seems to underway. As part of the card replacement cycle, by 2011-12, US might have 300 million cards deployed. At which time consumer education around contactless cards [in our wallets] will start. By 2012, we might have 3 million contactless readers, deployed primarily at cash replacement verticals and industries/stores with higher fraud rates. Given this picture, MNOs (e.g., AT&T, Sprint) will offer proximity payments in their handsets starting in 2012.

What else needs to change: Payment/Debit networks rules around PIN and contactless have to change to enable, for e.g., PIN debit via contactless [for amounts greater than $25] (Thanks to Scott for pointing out the nuance around Debit & PIN).

As deployment of contactless cards and readers takes place, MNOs will work out business models and place orders for phones. We have more than a couple of years to get there.

Do you agree with the above assessment. If this true, would startups serving this market survive till then? If so, how? What can the industry do between now and then to prepare?

Thanks to Steve, Japan for leading me to some of the stats used here.

Disclaimers: Figures mentioned are ball-park numbers, and are at different points in time. The figures are meant to provide a context to the discussion and to the point being made.

1 - K used above indicate thousands of units

CTST2009 - Conspicuous by their absence

I am at New Orleans attending CTST Americas 2009, the annual conference of the Smart Card Alliance. The Smart Card Alliance is an industry consortium of participants in the smart card industry, such as, smart card vendors, personalization equipment vendors, personalization bureaus, banks, processors, payment brands, standards bodies... The industries active in this alliance are Payments and Identity.

Notable topics discussed today, the first day of the conference, included government regulations, identity theft/fraud and privacy. As can be expected, mobile phones are impacting this group, especially in the payments space.

Throughout the conference, a track of sessions has been dedicated to mobile payments. The mobile payments sessions discuss usage scenarios, security, privacy, business models, results from pilot deployments, steps necessary to go commercial by learning from pilots, how the smart card and payments industry will work with the Mobile Network Operators (MNO), primarily from a business model perspective (sharing revenues)...

However, conspicuous by their absence were the MNOs themselves. MNOs were not speaking at any session. Other than one MNO, they were not even attending the conference. From their perspective, this forum does not even exist!

Correction: GSMA participated in one session on Day 2, which by proxy, implies all operators were present?

A few of the mobile handset vendors were present, only in the margins.

Does this mean that the MNOs are going to dictate terms? Are there other forums/fora where these public discussions are taking place. What does this say about the Smart Card Alliance and the CTST Americas conference? Would Cartes Americas replacing CTST help?

What are your thoughts? If you have any feedback, I'll try to get you answers while I am at the conference.

Cinco de Mayo greetings to all!

Freemium: What would consumers pay for

Freemium business model seems an appropriate way to attract people to a service, while trying to make the business sustainable/profitable. However, what aspect of the service would somebody pay for?

From a service provider perspective, getting your audience to become subscriber is preferred. Event-based premium content (akin to pay-per-view) is a good bridge to get from the free world to the subscription world.

What kind of events would somebody pay for? One of my friends has been working on trying these models for a couple of years now. He said live data is the key. As a consumer I can relate to it. Live data can be multi-faceted:

• Get access to information/event before others. Data services for businesses have been doing this for a while now.
  
• Experience an event while on the run/road. Popularity of smart phones is driving this category. A significant portion of the billion Appstore downloads are of this segment.
  

There might be related information for which folks would pay for:

• Inform when a friend/contact is in the vicinity
• Event of interest taking place in the vicinity
  

The above is a pull-push model. Based on personal filter settings (static data) and location details (dynamic data), the consumer 'pulls' events of interest (primarily in the personal/social space).

Prima facie, a service that can take advantage of the above triggers would require:

• Support for mobile devices, as the above use cases involve user mobility
• Sophisticated push engine: The success of BlackBerry service was based on their push model. If the guy pulls something, chances are that he wouldn't pay for it!
  
• Micro-payments: Each of these events are atomic, and paid for prior to consumption
  
• 1-click / Integrated payments: Make it easy for the consumer to get to what they want
  

The Apple Appstore is turning out to be a platform where interesting experiments are being tried as folks figure out a way for consumers to pay for services (more about this in another blog).

While on the topic of what consumers would pay for, would they pay for:

• Identity: Would a parent pay to ensure that adults don't participate in kids conversations (for e.g., at a chat room)?
• Security: The site must be secure, and that the information you share with the service is secure. To most people, this sounds like hygiene and should be covered by the service provider
  

What are your thoughts? Love to hear from you.

PS: Advertising revenues from businesses targeting the audience of the service is assumed to be a source of revenue.

Universal Financial Access by 2013

[Manju Murthy] In my earlier post, I wrote about the opportunities for disruptive innovations as emerging markets address financial inclusion, I had also written about Sanjay Bhargava, who is championing Universal Financial Access in India. He has graciously agreed to be a guest blogger at Commerce Insights (follows). Additionally Universal Financial Access India, a LinkedIn group, has been created to enable interested professionals continue such discussions and to network with each other. Please sign up to this group as well.

[Sanjay Bhargava] Manju, thank you for inviting me to be a guest writer on your blog and sharing in the dream that real and not cosmetic UFAI (Universal Financial Access in India) can be achieved by 2013.

I would like to start this first post with two extracts from the Nobel acceptance speech given by Prof. Muhammad Yunus. For the full speech see http://nobelprize.org/nobel_prizes/peace/laureates/2006/yunus-lecture-en.html

“We wanted to go to the moon, so we went there. We achieve what we want to achieve. If we are not achieving something, it is because we have not put our minds to it. We create what we want.”

“I firmly believe that we can create a poverty-free world if we collectively believe in it. In a poverty-free world, the only place you would be able to see poverty is in the poverty museums. When school children take a tour of the poverty museums, they would be horrified to see the misery and indignity that some human beings had to go through. They would blame their forefathers for tolerating this inhuman condition, which existed for so long, for so many people.”

I think it is important that we set ourselves measurable BHAG (Big Hairy Ambitious Goals) and my first attempt at articulating five goals for 2013 is there for everyone to look at and comment on. See this five slide presentation http://www.slideshare.net/sbhargav1/ufai-five-goals-2013

Do you think UFA should be a national priority for India and that the five goals for 2013 can be achieved with high innovation and low subsidies?

The presentation also refers to a set of whitepapers which can be downloaded from http://www.slideshare.net/sbhargav1

Most of you will not have the time or the inclination to read the whitepapers and may find them complex without explanation and context. I plan to do a series of bite sized posts highlighting the main points over the next few weeks. We are all learning and seeking solutions so critical comments are very welcome. Together we will find a way. I look forward to collective action and an interesting debate.

Disruptive innovations in payments - BoP style

In emerging markets, often the growth opportunity in the payments industry lies in addressing the un-banked. While addressing opportunities at the bottom-of-the-pyramid is challenging, financial inclusion empowers the un-banked to be both producers and consumers, thereby unlocking a viable business opportunity.

While looking at payments opportunities in India, addressing the unbanked / under-served forces its way into any brainstorming session. This could be because of innovations around branchless banking, novel methods of handling KYC mandates, reducing documentation/paperwork associated with opening a new bank account, zero-cost bank accounts, leveraging technology without being encumbered by legacy… When you are trying to create a profitable business from millions of customers who earn less than $100/month, you think thru’ the problem in a very different way. Resulting in a raft of innovations can be truly disruptive. CGAP has been successfully promoting this cause for a while now. I've enjoyed participating in the CGAP group on LinkedIn as well.

It is in this context that I ran into Sanjay Bhargava, who has been championing Universal Financial Access. He brings a lot of energy and enthusiasm into a daunting initiative, and makes it seem achievable. His attitude is so infectious, that I figured a lot more space needs to be devoted to the Universal Financial Access project (subject of another blog).

Is BoP a lost cause? Is Universal Financial Access an oxymoron? What are your thoughts?

End of independent mobile payment players?

It is difficult to have missed the news (here, here, here) about Obopay receiving $70 million from Nokia. This is on top of the earlier round (Series D) of $20 million in April 2008.

What does this investment indicate:

• Obopay's CEO is skilled in raising money (you'll find this interview interesting)
  
• Mobile payments industry is at an inflection point, and on the verge of take-off
• Nokia sees Obopay as best suited to take advantage of the opportunity.
  
• Nokia is seeing Obopay as its next billion dollar baby?
  

One of the signs of an emerging industry crossing the chasm is investments from the large players. This happened in the email space (Microsoft buying Hotmail...), Online Advertising (Yahoo/Blue Lithium; Microsoft/aQuantive)... Startups many a times do not have the ability to scale quickly to address the available market efficiently. Alternatively, the economics of the space do not justify a startup building out the sales, delivery and service infrastructure. In such cases, an existing player buys a startup to either move up the value chain or to increase the breadth of their offering.

Does Nokia's interest in Obopay suggest this?

Obopay has alliances with scheme operators (MasterCard), banks (Citi, Yes), carriers (Verizon) and device vendors (Qualcomm, Blackberry, Nokia).

Any of the above partners could have made a large investment. Qualcomm in an existing investor in Obopay. Does Nokia's investment indicate that the device vendors have an inside track to leverage the mobile payments market. Would a payment scheme operator or a telecom operator have been able to grow the mobile payments market better than a mobile device vendor?

In terms of registered users and money flowing thru the system, PayPal mobile seems to be the front-runner in mobile P2P payments in the US. mChek seems to be the front-runner in India.

Does Obopay have strategic alliances or IP that can block these early leaders? Can Nokia help Obopay move ahead. Has there been any development in the recent past to indicate the slumbering mobile payments industry is getting ready to sprint?

Are mChek and PayMate next in line for a bear hug?

What are your thoughts?

Authenticating online transactions

The payment ecosystem is comfortable with the authentication of a payment card holder at the time of retail transaction (about 1.5 basis points of fraud). In retail transactions, the user is authenticated by the checkout clerk, and the payment session is authenticated by the payment server. Two sets of checks using independent channels.

In online commerce, similarly, multi-factor authentication (MFA) is being used for strong authentication to achieve the same degree of authentication. The authentication factors used, include:

• What you have (the payment card) [weak as a factor unless a card reader is also involved]
  
• What you have (the cellphone / hardware token registered with your card)
  
• What you know (the PIN)
• Biometrics (who you are): This is being used by some, with the potential for increased usage)
• One-time password / Signature (yet another knowledge factor [what you know])
  

Banks are deploying hardware in a variety of form factors to enable MFA for [more] secure online commerce. There is lots of debate whether these investments are appropriate or being mis-directed.

Unconnected Chip-n-PIN readers are being endorsed by payments associations and being deployed by European banks to generate OTP (one-time passwords) for secure access to online banking sites. The simplicity of unconnected card reader devices make them secure. They are not connected, therefore are less prone to being attacked by malware. However an additional device to carry around when you travel (or otherwise) is not terribly convenient. There is still the issue of Adversary/Man-in-the-Middle (MITM) attack.

Using SMS as an alternate delivery channel is another alternative (saves cost of deploying readers and hassle of carrying readers around). Cell phones are used to communicate the OTP or Transaction Number (TAN), which the user enters at the online site. For those that don't care for cell phone and/or SMS/text messages, an IVR (interactive voice response) variant of the above is also used.

Hardware token, either the unconnected kind or the USB kind, are also used, but not in the same class of security solution as what you know (PIN) is not involved.

The emerging consensus, including observing the above alternatives, is that a hardware based solution over an alternate channel be used to generate/communicate the additional authentication factor (what you know). See related post here and here.

There are varied opinions about the usability and security profile of these offerings, including:

• Does a Chip-n-PIN reader put a user at physical risk?
• Is SMS safe enough (SMS is a non-confidential plain-text channel)?
• Are smart phones safe enough?
• Should one of the authentication factors be sent over an alternate channel. E.g., user sends the OTP or TAN over SMS to thwart MITM attacks
  

Are the current approaches to securing online transactions adequate? Are there any fundamental lacunae that we need to plug to get a solid foundation on which we can build the necessary security solution? What are your thoughts?

[10Aug09]: Interesting related post from Finextra (link)