“….the algorithm used to encrypt GSM phones is over 20 years old.”

Mobile payments are a hot topic, particularly for companies and merchants targeting the unbanked – or underbanked – segment.  Research by Mercator Advisory Group shows that 68% of consumer payments (by dollar volume) will be electronic-based in 2012.  The group estimates that volume to be 75% by 2017.  Electronic payments offer huge cost savings for merchants, as well as financial institutions.  Consumers are demanding more ways to operate remotely as well as easy ways to make payments.  It’s a win-win for both sides.  However, the fraud issue cannot be ignored.  Since smartphone technology is fairly new, few anti-fraud tools have been developed and even fewer have been deployed.

As smartphones provide access to more sensitive data each year, the need for security is of monumental importance.  There is some protection available for mobile phones, such as McAfee’s VirusScan Mobile (for Windows Mobile phones) and the VeriSign(R) Identity Protection Access for Mobile.  While these programs protect the phone against viruses, worms, spyware and malware, they do not encrypt data being sent or received.  However, VeriSign’s application does use a two-factor authentication tool and iPhones are equipped with Remote Wipe, which can erase the phone’s data remotely, should the phone be lost or stolen.

There are varying levels of security issues, depending on the type of mobile payment (mobile web site, contactless, SMS, etc).  Vulnerabilities of standards, infrastructures, platforms, and technologies (i.e. GSM, NFC, SMS, Bluetooth, RFID, mobile applications, etc.) pose a complicated issue for researchers to develop protections against secure data loss.  Mobile malware and spyware, Trojans, phishing attacks and third party applications add even more threats.

The future of mobile payments, tagged sometimes as ‘m-payments’, would have credit card data embedded on the SIM card or on a chip in the phone.  (Fingerprint scanning is envisioned further into the future.)  Remote access to the phone and its payment applications would be necessary should the phone be lost or stolen.  This would require agreements between carriers, equipment manufacturers and financial institutions.  Additionally, organizations that deal with sensitive data (i.e. financial, medical, personal identification) would still have to comply with various regulatory requirements (such as HIPAA and SEC) for protecting data.

A new industry consortium, the Financial Services Technology Consortium (FSTC), formed in 2009, is tasked with developing standards for secure mobile payment transactions, regardless of the device or carrier.  Jim Pitts, managing executive of the FSTC’s Payments Standing Committee (Payments SCOM), stated that the standards may also recommend that individuals be authenticated before making a purchase.  Standards will likely include the use of a SIM card or data chip to authenticate the device and authorize the payment.  Due to various technologies and products in use today, the costs required by all parties will likely cause delays in the standards being accepted as well as compliant products and services being deployed.

In the UK, the migration to EMV technology has reduced fraud in face-to-face transactions since EMV adoption in 2003.  The EMV standard operates with EMV-compliant cards (which have embedded chips instead of magnetic stripes) and EMV-compliant POS terminals.  The chips require a PIN entry for a secure EMV transaction.  The acronym EMV is derived from the initial letters of Europay, MasterCard, and Visa, all of whom cooperated to create the technology standard.  MasterCard merged with Europay in 2002.  JCB and American Express have since joined the organization as well.

EMV is a perfect example of two-factor authentication, where two different factors are required to complete a transaction, and has been referenced as a key solution for secure, fraud-resistant transactions.   There is a strong push for EMV abroad and to encourage merchant acceptance, merchants are held responsible for fraud resulting from any non-EMV transactions.  As more countries adopt EMV technology, they are also banning signature transactions.  Australia will ban signatures by 2013.  Canada will not accept magnetic stripe transactions after 2015.  These added security layers will push payment card thieves to focus on easier targets, such as the U.S.  EMV employed as the only method for secure face-to-face transactions abroad is also altering how U.S. cardholders are conducting (or abandoning) transactions in these countries.  This could result in lost revenue for international merchants and will hopefully put the pressure on issuers and merchants in the U.S. to adopt EMV.

“Australia will ban signatures by 2013.  Canada will not accept magnetic stripe transactions after 2015.”

Ecommerce Data Protection

According to the U.S. Census Bureau, ecommerce sales in 3Q 2009 were estimated at $32 billion, 3.7 percent of total retail sales – an increase of approximately 2.1 percent from 3Q 2008 while total sales decreased in the same period.  Visa, MasterCard and JCB already have 3-D Secure protocols in place for online purchases.  Verified by Visa, MasterCard SecureCode and J/Secure (JCB) all require the cardholder to enter a password or unique ID to complete a transaction.  Cardholders must register with the programs for the extra layer of security to be added during a transaction.  Unfortunately, these programs have not been well received or implemented due to added costs to the merchant and low acceptance from cardholders.  In response – and to support EMV online – MasterCard has developed their Chip Authentication Program (CAP) and Visa has created their Dynamic Password Authentication (DPA), a different version of CAP.  To date, deployment has been minimal.  Last week, ArcotOPT was announced as the first solution using CAP on mobile phones for ecommerce and online banking.  Although the company, Arcot, is based in California, the product was released in Europe where EMV has a strong presence. We are not likely to see deployment in the U.S. until EMV takes hold here.

Going Contactless

As contactless card adoption grows (mostly in the small ticket market – fast food, convenience stores, etc.), so does the acceptance of the added security already in place.  Contactless cards include a unique CVV for each transaction.  If thieves were to obtain the payment card data from a transaction, the CVV could not be used for another transaction.  Additionally, contactless payments do not transmit the cardholder’s name and some also do not include the account number.  MasterCard teamed up recently with RIM to deploy MasterCard PayPass contactless stickers on Blackberry phones.  After each PayPass transaction, a confirmation email with the transaction information is sent to the Blackberry phone. Verifone has combined its end-to-end encryption solution, VeriShield, with EMV to support contactless payments beginning this spring in the UK and a few other regions.  End-to-end encryption does not supply any usable cardholder data to a merchant’s POS device or network, thereby reducing fraud risk.

How About Mobile Shopping?

Smartphone technology, not to mention the iPhone, has significantly increased the interest in mobile payments.  Presently, contactless stickers can easily satisfy this demand (as mentioned above with MasterCard and RIM).  Some major card companies have also tested near field communication (NFC) as a contactless payment option. NFC is a short-range wireless technology which enables the exchange of data.  Payments using NFC also require a PIN to complete the transaction.

It is apparent that various options for added payment security are already available. As to why these new security options are not yet deployed in the U.S. rests on the concern for cost and revenue stream.  Mobile carriers want a piece of the pie when transactions are made using devices over their networks, thereby slowing the adoption in carrier channels.  EMV would certainly incur costs for merchants (new POS devices) and card issuers (new cards with chip technology).  Despite these new security protocols, a strong fraud risk still exists with merchants, processors and companies storing sensitive data (against PCI compliance), as well as physical cards being cloned or skimmed.  Costs associated with fraud in the U.S. today are written off as a cost of doing business. Pending government legislation, card association guidelines and PCI compliance appear to be the only factors pushing for faster adoption of stronger security measures.

Okay, so what exactly does that mean?  Well, traditionally, merchants only had the option of accepting electronic payments online in the form of bank drafts, and debit and credit cards from the major card brands – Visa, MasterCard, American Express, Diners Club and JCB.  That is until payment product innovators discovered that merchants were losing potential business from consumers who did not have bank accounts or credit cards.  Most importantly, in the ecommerce space, some consumers are simply wary of using cards and bank account information for online transactions because of the fraud risk.  Most of this concern stems from consumers’ lack of trust in web site security.  Additionally, with card companies cutting cardholder credit limits, alternative payment methods are the only option.

Merchants:  Think Outside the Credit Card Box

Merchants not offering alternative payment options online are limited to accepting cash, money orders or checks from those customers.  Checks require clearing and cash can only be paid in person.  Those options can delay revenue (or limit or restrict revenue in the case of a check not clearing) for the merchant. Merchants offering payment alternatives reach a wider consumer base and satisfy more customers as a result.

Merchants operating ecommerce portals should consider two avenues when researching and implementing alternative payment options:

• Offering a variety of payment methods, such as PayPal^™, Bill Me Later^®, Google^™ Checkout and RevolutionCard (a physical card and new payment network)
• Enabling the acceptance of foreign currency

PayPal^™ has a large consumer base of roughly 150 million users.  Bill Me Later^® was acquired by eBay (PayPal’s parent) last year.  RevolutionCard^™, the first PIN-based credit card, is not embossed, so no personal data is stored on it.  There are smaller players in the market as well, but they have yet to take as much hold as these industry leaders.

Click and Buy, a payment system based in London, offers 126 different currencies and 46 different payment methods to their merchants.  According to an alternative payment study conducted by YouGov for Click and Buy, more than 50% of regular online shoppers will cancel a potential purchase if their preferred payment method is not available.  Although U.S. online retailers are not pressured as much for foreign currency acceptance (major brands are accepted internationally, but cardholders are charged foreign exchange fees), it would certainly enable a merchant to grow globally.

Ecommerce merchants are becoming favorable to alternative payment offerings, simply to reduce their expenses in relation to interchange fees, which have risen 25 to 90 percent (depending on card type and a merchant’s business operations) over the last 20 years.  PayPal doesn’t pass along interchange fees and Revolution Money’s RevolutionCard saves merchants money by charging no interchange fees and lower processing fees per transaction than major card brands.  Merchants are turning these savings into loyalty and cash-back programs for their customers.

Looking Forward:  The Future is a Bright Alternative

Innovation in alternative payment products has been primarily outside the banking world.  Research consulting firm Celent estimates that by 2012, banks will see a decline of $1.2 billion in interchange revenue due to increasing acceptance of online alternative payments. Banking institutions are adopting alternative payment options of their own – for their customers as well as merchants.  Secure Vault Payments, a new payment solution, is now offered by NACHA, the electronics payment association that oversees the Automated Clearing House (ACH) network, (the electronic network for financial institution transactions in the U.S.)  Labeled NACHA SVP, it is an up and coming contender in the alternative payment space.  It is helping banks to retain customers and expand their merchant offerings.  Still in its infancy, it has become popular in the education industry.  The University of Georgia launched SVP in April as a new tuition payment option.  Other educational institutions are following suit.

Celent also estimated that by 2013, online payments will climb to $268 billion and 30% of those payments will come from alternative payment sources.  This increased market acceptance will certainly move alternative payments into the mainstream.

Although many large retail chains such as Regal Cinemas and McDonalds have the technology available, the process has been put under a great deal of scrutiny because it is said to be more susceptible to identity theft and other types of fraudulent activity. The devices are easily hacked using a wireless frequency. Regardless of the security risks, all the major credit card companies were ready to get their piece of the action. In July of 2005, AMEX launched ExpressPay, which was quickly ditched because of a lack of response by consumers. The Discover Network released its Zip technology, Visa Inc released payWave, and MasterCard has PayPass.

MasterCard Mobile recently released its Secure Set-up for MasterCard PayPass on mobile phones. They call this the Over-the-Air Provisioning Service, and it is the first program to enable issuers to perform over-the-air personalization of their cardholders’ mobile devices. Mobile MasterCard PayPass enables mobile devices to perform payment transactions at merchant locations with PayPass enabled point-of-sales terminals. In order for account holders to use their mobile phones to make purchases, their mobile phone must be equipped with Near Field Communications (NFC) and a mobile data subscription. First, the PayPass application is downloaded onto the consumer’s mobile phone. The application is available through their issuing banks website. Then, the PayPass application is personalized with the consumer’s individual account details.

With the wide range of savvy hackers out there, it may still be hard for consumers to feel safe about the contactless payment technology – whether it be on a mobile phone or on a credit card. As for merchants, my advice is hold of off on buying your contactless equipment just yet.

Previously, I have talked about Google’s Android platform working with Visa on a service that sends you an alert if any payments have been made on your Visa card. This is great in helping to protect against fraud, and will also help in locating ATMs, but I don’t consider this to be a new technology.

In 2007, Visa partnered with Qualcomm, a wireless chip developer, to create technologies that allow consumers to make credit card transactions with a cell phone and a reading device. This would add another way for wireless carriers to make additional revenue by being paid a percentage of the transaction.

Now in 2008, in Brazil, Visa announced the availability of remote payments by Banco do Brasil. The service allows Visa cardholders to pay with their mobile device and confirm the transaction via text message. In Korea, T-Money provider Korea Smart Card Company, card issuer Shinhan bank, and Korea Telecom Freetel have partnered to make it possible for commuters to add funds to their T-Money balance automatically on their cell phones. T-Money is a rechargeable card used to pay for the Korean transit system.

Here in the United States, Visa is in a pilot program with Chase Bank to provide personalized offers sent to cell phones via SMS text giving discounts and special deals from online merchants. I wonder if standard text rates apply to this. I am not a big fan of this program but I can see how it can enhance advertising for businesses.

Visa is also working on providing NFC (Near Field Communication) with several large banks across the United States. NFC is a short range high frequency wireless communication technology that enables the exchange of data between devices. This technology is most frequently used for mobile phones.  This technology is also in its pilot stages in France with “Payez Mobile” and in Spain using “payWave”.

Is this mobile technology going to cause an increase of stolen cell phones and future security issues? Is cell phone payment technology going to be the way of the future?

Visa and MasterCard have developed ways to improve the security of online transactions. Verified By Visa and SecureCode allow the card holder and card issuer to authenticate each other. This is done by exchanging digital secure certificates. Card holders can be assured that they are dealing with a real merchant and conversely provide a merchant with proof of a real cardholder. A digitally signed record of the transaction is created. Most issuing banks encourage card holders to sign up for these programs and many online merchants give consumers the opportunity to sign up before they proceed with payment.

Using these services is quick and easy. Card holders select a private password which they use to shop online with participating retailers. No additional software is needed for this added security.

MasterCard has recently decided to deploy Actimize, a provider of transactional risk management software for the financial services industry. Actimize has a debit fraud solution, real-time risk scoring and fraud prevention service for PIN-based transactions offered by MasterCard to its customers. This program is unique because the technology detects fraud and suspicious activity at the card, device, account level and many other dimensions.

Although a huge push for regulation of the Associations is being pushed through Congress there is no better way for a merchant and card holder to protect themselves then keep their eyes open for red flags.

• Beware of calls from your bank saying that they are verifying possible fraud on your account. Often scammers will ask you to verify the three digits on the back of your card. Your bank already has that information and does not need you to verify it.
• Make sure when you make purchases online that you are on a secure environment, and you are making your purchase from a reputable company.
• Don’t Fax or email your credit card number to anyone.

We can’t detect all fraud, all the time, but we can make leaps in the right direction so we can begin making it harder for fraud to occur.

Technology in the payment card industry has grown tremendously in just the last 5 years. Merchants are able to accept payment using any java enabled cell phone, and can even turn their laptop into a credit card terminal. But the best is yet to come.

• Google recently announced the Android smartphone, and Visa is planning to develop e-payment applications for the device. This technology will allow merchants to receive notifications of account activity to their mobile device, locate ATMs that accept Visa, and Google maps to quickly locate a wide arrange of merchants to redeem visa rewards.  Soon, you will be able to make purchases at retail locations using your mobile smart phone.
• Visa also plans to release a money transfer pilot program by the end of 2008, which will allow Visa cardholders to use their mobile phones and PDAs to send funds directly to another visa card holder. I guess you better make sure you are not dialing the wrong number.
• MasterCard is introducing Chip and PIN.  Instead of swiping a card with the magnetic strip on the back, you will insert a card that has a computer chip embedded on the front. Instead of signing to verify a payment, you will enter a PIN.
• PayPass is MasterCard’s “contactless” payment technology. A tap of your card is all it takes to pay at the checkout; however your purchase must be under the pre-specified floor limit.

I am still a big fan of Biometrics. I believe that we will be able to pay for items using our finger print or a retinal scan. Although there have been recent failures by some companies to create the technology, my opinion is it’s the future of payment processing.

You have to get approval from your bank to process higher volumes and you run the risk of increased chargebacks-a vexing problem for online merchants. How do you prepare your business for expansion? For starters, you have to think about scalability from the beginning. Before you accept your first order, ask yourself “Can I accept double the amount of current sales or triple?” While it usually takes time to build a steady client base, you don’t want to be unprepared should your site get flooded with orders.

When you think about scalability, having the right infrastructure and software from the beginning will enable seamless growth down the road-even if it happens unexpectedly. The right transaction management software allows you to process higher levels of credit card transactions and effectively manage chargeback cycles. The last thing you want is for your website to go down during Black Friday or during the highest buying periods.

Your transaction management system is absolutely critical to successful scalability of your operations, however, at the basic level, your applications have to support the software.

Good design is the foundation of a highly scalable application. At no other point in the lifecycle of an application can a decision have a greater impact on the scalability of an application than during the design phase. Go with a design team that is well-versed in e-commerce platforms.

When choosing your scalable transaction management system, look for a plan that will grow along with you.

What to look for in a transaction management system:

• Able to process transactions quickly and securely
• Processes unlimited transactions from nearly anywhere in the world.
• Scalable: grows with your business by supporting an unlimited number of transactions regardless of business model.
• Allows unrestricted numbers of users on one account (ideal for large sales forces)
• Experienced technical support.
• Integrates with your existing system, allowing for manual processing from any computer or through a payment gateway via a variety of connection methods.
• Offers a high level of security and fraud features to help you keep within your allowed chargeback ratio.

With these tips in mind, you can look forward to continued business growth without worrying about scalability down the road. A prepared business owner is a successful business owner!

What is the TMF Match List?

When you apply for a merchant account, the bank will check to see if you are on the Terminated Merchant File (TMF). If you’re on it, this means that another bank has terminated a merchant account with you, and sends up a red flag to banks that you’re a credit risk. The chances are slim to none of getting approved once your name hits the list. Getting on the TMF list is the equivalent of getting blacklisted.

How do you get on the TMF List?

Unfortunately, it’s not that difficult to get on the list but it is a challenge to get removed-even if you didn’t deserve to get on the list in the first place.

All it takes is one accounting mistake (yes, even on the bank’s end), technical glitch or dispute over billing practices and your business is in jeopardy.

So how do you get on the Match File? The most common ways include: 

• Credit card fraud. If your fraud detection controls aren’t strong enough you could end up with too many chargebacks.
• Friendly fraud. This is when a consumer disputes a legitimate charge such as from an adult website.
• Factoring. Factoring is when a merchant deposits transactions for sales generated by another business.
• Excessive chargebacks-approximately 1-2% of sales.
• Fraud. Types of fraud include not delivering products or misrepresenting products or services.
• Violating the merchant agreement
• Owing money to a bank or processor

One of the fastest ways to get on the Match list is to close your merchant account and not pay your last statement. It’s a simple oversight with costly consequences. Even a matter of a couple of dollars can land you on the dreaded list. Fortunately, this is one of the easiest fixes. Read on for tips on getting off the TMF list. 

If you have an unscrupulous merchant account provider, you could wind up on the TMF if your provider counts chargebacks in the month it comes in instead of the month the original transaction occurred. If you do fewer sales in the month the chargeback is processed, your chargeback percentage could skyrocket. 

How to get off the TMF list

Bad things happen to good people all the time-but that doesn’t mean you can’t do anything about it. If you find out that you’re on the TMF list, there is hope-but it will take some work. If you’re thinking that you can get a new merchant account by changing your business name or having a spouse or relative sign up for you, be weary; banks are savvy to this scheme. Banks have ways of finding you out through social security numbers, ISP addresses, and public records.

Depending on why you’re on the TMF, you will have an easier-or a harder-time getting off of it. If you committed fraud, you probably won’t ever get off the list.

As soon as you find out that you’re on the TMF, call your merchant account provider-or the company that placed you on the list. Prepare to work to speak to many departments until you get in touch with the right person. You might end up being referred to the processing bank.

If you believe your business or name was mistakenly added to the Match file, you must work with the acquirer that added the listing to the file. Only the company that placed you on the list is authorized to request a change or deletion of the information.

If your acquirer recognizes that the listing was in error, they must request the file correction immediately. Examples of errors include termination for reasons that don’t warrant a public listing such as inactivity.

To request a change or deletion, the listing bank submits its request to MasterCard International in Purchase New York. The designated individual at MasterCard will review the merchant’s explanation and listing bank’s justification for change or removal from the listing. MasterCard International reserves the right to deny the request. The listing bank must justify its reason for the deletion.

Losing your merchant account and not being able to process credit cards is stressful but try to remain calm and act courteously to every person you talk to, no matter how upset or frustrated you are. Once you reach someone that knows something about your situation-probably in the risk department-he or she should be able to tell you why you are on the match file and explain your options to get off the file. Get a direct phone number for someone that you can correspond with about the situation in the future.

If you were placed on the match file for a high chargeback ratio, time is usually the only thing that will get you off the list. Your bank needs to know that it isn’t going to get stuck with unpaid bills resulting from the merchant’s former customers’ chargebacks.

If you didn’t pay your final bill, you may only need to pay off your debt with your former processor. You could be re-instated after a week or so after you make payment.

On the other hand, you could face more opposition. It can take several weeks to get off the match file in many cases. Sometimes you will have to negotiate to get charges resolved or fees removed. If after a few weeks you don’t make any progress, you may need to hire a lawyer.

Processors often use arbitration to avoid taking individual cases to court. It’s cheaper than going to a court and the results are often better for both parties. If you need legal assistance in getting of the Match file, seek a lawyer with experience in bankcard law.

Read more about how to stay off the TMF MATCH List.