Trends and Developments in Chip-enabled Payment Instruments
A number of developments have occurred in the payments field related to the use of chip-enabled instruments, which are moving rapidly from hype to reality. The changes driven by these developments will impact corporate businesses in several different ways. Naturally, the nature of a corporate’s business (e.g. industry sector, B2B, B2C, direct sales force, retail outlets, use of electronic channels, etc.) will shape that impact to a large extent.
The main driver for the chip enablement of payment instruments has been MasterCard and Visa’s global strategy to migrate their members from magnetic stripe to EMV standard card technology. The almost global imposition of the ‘liability shift’, whereby fraud losses will fall on a non-EMV compliant party, combined with regional interchange incentives has given issuers and acquirers a strong incentive to migrate sooner rather than later. Some countries are migrating to EMV without any local mandate, driven by both fears of fraud migrating from EMV compliant countries and the potential for profitable exploitation of EMV technology. The move to EMV is global, with countries that are migrating or have migrated to EMV in Africa, Asia- Pacific, Australasia, Canada, Europe, Middle East, and South America. American Express, JCB and several national card payment schemes (such INTERAC in Canada and SPAN in Saudi Arabia) have also adopted this technology.
A major EMV-related business opportunity is EMV’s ability to support prepaid and pre-authorised cards that, firstly, can be used in offline terminals without any risk of loss by the card issuer and, secondly, ensure that the cardholder can be reimbursed if a card is lost, stolen or damaged. The strict control over cardholder spending opens up new markets in the under-banked and unbanked markets. EMV prepaid corporate cards place a firm limit on employees’ spending that is effective even when employees travel to countries where offline authorisation predominates. The ability to reimburse cardholders when cards are lost, stolen or damaged means that these cards are highly suitable for applications in which loss of funds would be unacceptable, such as payroll cards or government benefit cards, and when frequent online reloads are difficult.
Offline use has obvious benefits to both merchants and issuers in facilitating business in emerging economies with poor and expensive telecoms land line infrastructures. In more mature economies, switching from online to offline authorisation and capture of transactions can reduce telecoms costs. It can also avoid the need for costly upgrades to switches and line capacity to cope with increasing volumes and maintain acceptable transaction times during peak seasonal activity.
The MasterCard Open Data Storage (MODS) and Visa Smart Secure Storage (VS3) specifications provide application programming interfaces (APIs) for data storage and retrieval with EMV applications on chips. These initiatives open the way for issuers to partner with corporates to support, for example, retailer loyalty schemes and identity based applications.
A significant development in EMV cards is the introduction of contactless cards that allow ‘tap and go’ transactions without the need for PIN or signature verification for low value payments. Contactless cards are ideal for applications where transaction speed is critical for fast, high volume customer throughput. Examples of such applications (not all EMV-based) include road tolls (e.g. Italy’s Telepass and Malaysian ETC), stadium ticketing (e.g. MBNA’s Manchester City MasterCard), transit ticketing (e.g. Hong Kong’s Octopus card and Barclaycard’s OnePulse Oyster/Visa payWave credit card) and quick service retailers (e.g. Starbucks’ and Costa Coffee’s payment/loyalty cards).
The Smart Card Alliance has reported comparative average transaction times at the US pharmacy CVS for cash, card (without signature) and contactless transactions as 33.7, 26.7 and 12.5 seconds respectively, giving contactless an advantage of 14.2 seconds over non-contactless cards and 21.2 seconds over cash. It is noteworthy that many of these products combine multiple functions.
Contactless cards have the potential to replace cash transactions, provided that the cost/benefits equation is favourable. Aside from the obvious comparison of the costs of holding and transporting cash with card interchange fees, a major factor for merchants to consider is the increase in spend that has been seen in contactless trials and early schemes. CVS were reported in Card Technology in late 2005 as achieving a 20% to 30% increase. In June 2007, MasterCard presented figures for increased spend on PayPass cards of 28% to 42% and increases in transaction volumes of 33% to 52%.
Earlier this year, Javelin Strategy & Research published a report forecasting that, subject to industry-wide cooperation, 57 million consumers would be making contactless credit card payments by 2013, over double the 24.8 million in 2008. Even with cooperation, the forecast was for 34 million users. It is their view that contactless payments will pave the way for mobile phones and handheld computers to become electronic wallets. One of the main industry issues relates to the lack of universally accepted technical standards.
While there appears to be a consensus that proximity payments will use near field communication (NFC) technology, network operators, handset manufacturers and card schemes have held different views on the details. Visa and MasterCard both use NFC technology for contactless payments. In Europe, the opposing views of the GSM Association (GSMA), which represents over 750 GSM mobile phone operators, compared to Nokia and MasterCard over the host controller interface (HCI) were resolved in February by the European Telecommunications Standards Institute Smart Card Platform (ETSI SCP) which, after a 75% majority vote, has introduced the TS 102 622 standard. The difference was that the GSMA approach allowed the HCI to talk to different secure elements, including the SIM card, Mini or Micro SD cards or the handset, on which the NFC application could reside, whereas the Nokia/MasterCard approach was more restrictive.
The GSMA has announced that later this summer it will release “a preliminary set of minimum requirements for handsets containing NFC chipsets.” However, the NFC Forum (of which the Mobey Forum is a member) has also released NFC specifications. According to a study released by ABI Research in January, 419 million NFC chipsets will ship in 2012 with steady growth over the next five years. Agreement on standards is essential to enable chip set manufacturers to develop commercial products and gain the economies of scale that will drive down costs.
In relation to mobile payments, a key issue is agreeing the business models that will allow consumers to choose to have any issuer’s payment application on any manufacturer’s handset and use it over any operator’s network. The European Payments Council (EPC) and GSMA are working together to produce “a contractual framework document detailing the minimum set of requirements for a trusted service manager (TSM) to interface with banks and mobile operators.” The TSM (also known as a trusted third party or TTP) provides a single point of contact for mobile operators and manages the distribution, configuration and activation of mobile services on NFC-enabled handsets. The Mobey Forum also supports this model. A 2008 survey by Mobile Payments World and Edgar Dunn stated that: “Respondents are leaning toward having a trusted third party – most likely a technology provider – deliver the NFC-application platform to manage customer payment information.”
There may be some difference, however, between the banks’ and operators’ expectations on revenue sharing. From an Edgar Dunn/GSMA 2008 survey, operators see the SIM Toolkit as the preferred vehicle for financial services but prefer a revenue model based on per transaction fees or a percentage of transaction value – they think a ‘SIM rental’ model is unlikely. This may contrast with the issuers’ current thinking centring on renting space on the SIM.
The potential size of the market gives operators and issuers every reason to reach an acceptable accommodation. In April 2008, Gartner forecasted that users will increase from 32.9 million in 2008 to 103.9 million in 2011; Juniper Research estimates that around 52 million people will use mobile payment services resulting in a market worth US$11.5bn by 2011; and the Edgar Dunn/GSMA survey expects that there will be 1.4 million mobile wallets (25% of subscribers) by 2015 and that 346 million subscribers will make at least one contactless transaction in 2012.
The combination of EMV contactless payments and prepaid applications gives issuers a powerful product. Typically, consumers compartmentalise their spending, using different payment instruments for different types and values of payments. For example, for groceries debit cards may be preferred, while for white goods and utility bills credit cards may be seen as appropriate. Preferences can vary by age, income, region and according to cultural differences, such as the degree of credit averseness. Prepaid cards can appeal to consumers who see them as more appropriate for low value transactions (keeping high volumes of small transactions off of their bank account or credit card statements).
Consequently, there appears to be a good fit with contactless payments, which also address the low value payments space. As prepaid products can be issued to virtually anyone (including the under-age, unbanked, under banked and other sub-prime segments) because of the absence of credit risk, EMV contactless prepaid products have the potential to replace a significant proportion of cash transactions. Transport for London (TfL) has seen the potential for these products to replace their Oyster card for mass transit ticketing and is in discussions with MasterCard and Visa. Visa Europe is about to pilot a new, more secure, contactless prepaid specification – a demonstration system has already been developed for Visa by Aconite and presented at the Visa Prepaid Summit, as well as at VRL’s Cards and Payments 2008 in Brussels.
A key benefit of EMV is its strong security based on asymmetric encryption, unlike the MiFare card’s recently broken security. MiFare is one of the most commonly used smart cards, found in transit, identity, access control and many other applications. EMV products, whether in cards, phone or token form, can be used by corporates to support such applications more securely. Barclays has reported zero fraud from its first one million online customers using EMV cards to authenticate large value transactions and international payments. Such uses of EMV cards are addressed by MasterCard’s chip authentication protocol (CAP) and Visa’s dynamic passcode authentication (DPA) specifications. In relation to corporate cards, EMV reduces fraud and avoids the administrative cost of investing fraud issues.
The expected explosive global growth in chip-enabled payments offers significant business opportunities to issuers, acquirers, merchants, mobile network operators, chip-set manufacturers and corporate card users alike.