Showing posts with label EMV. Show all posts
Showing posts with label EMV. Show all posts

Friday, 18 June 2010

Retailers urge UK Government to back move to reduce Debit card transaction fees


Debit card transactions cost four times more to process than cash payments, says the UK's leading retail trade association, raising concerns that the move from cash to contactless debit cards and NFC phones will increase retailers' overheads.

Cash transactions costs UK retailers an average of 2.1p to process while a debit card payment costs 8.5p and a credit card transaction costs an average 34p, says the British Retail Consortium (BRC).

"Retailers are seriously concerned that banks plan to make the higher debit card charging regime the norm for the emerging contactless and mobile phone payment methods," says the BRC, and "if that happens, retailers would face huge increases in their costs as these new ways of paying replace cash – particularly for low value purchases."

"As part of its promised clampdown on irresponsible banking behaviour, the new Government should........to read the full article click here

Consulting Smart Ltd provide specialist consultancy on the design and deployment of smart card and NFC technologies. For more information on how we can help your organisation realise the full benefits please see www.consultingsmart.co.uk or email us at info@consultingsmart.co.uk

Sunday, 25 April 2010

Telefonica and Visa deal for NFC Payments

By:
Dan Balaban

Mobile operator group Telefónica and Visa Europe have an agreement to promote the rollout of cobranded cards and later mobile payment with NFC phones, according to a Telefónica executive, who said the telco seeks a share of transaction revenue.

Michiel van Eldik, director of new business and innovation at Telefónica SA, speaking at the WIMA NFC conference this week in Monaco, revealed that the large mobile operator group plans to get more deeply involved in payments, not only in Europe, but also in Latin America, where it has major operations. That could involve seeking to share transaction and related revenue with card schemes and banks.

“If I look at the sort of arrangements we have in place between Visa and MasterCard, across our footprint, then in certain pockets we will actually take a slice of the dice,” he said during a question-and-answer session following his presentation at the WIMA conference. “So we take a cut from what Visa basically gets. And that’s actually the model we’re pushing across our footprint.”

It would mean Telefónica would get a “certain percentage point” of the merchant transaction fee, he said, though he declined to specify how big a slice the telco seeks to take.

It was not clear whether the statements by van Eldik, speaking off the cuff, represent the overall strategy of the giant telecom group. But he told NFC Timesthe deal with Visa, signed a couple of months ago, would involve cobranded cards in the six countries in which the group does business in Europe, which, therefore, would include Spain, the United Kingdom and Germany. Telefónica is also working with MasterCard in Latin America, although is still in negotiations. The idea would be to move the payment application to Near Field Communication phones, when the devices are available.

A source outside of Telefónica also told NFC Times that the telco group and Visa are involved in talks with major handset maker Samsung to try to bring more phones supporting NFC to the market. The deal, if completed, would involve commitments for phone orders in exchange for Samsung agreeing to produce perhaps two or three new NFC models, said a source.

A spokeswoman for Visa Europe declined to confirm any deals with Telefónica, saying only that “Visa Europe’s position is that it cannot comment at present.”

But a source with Visa Europe told NFC Times the card network and Telefónica are “planning some activities together” and were in general discussions about “possible opportunities.”

It wasn’t clear how new revenue-sharing deals might work between the telco and card schemes and banks. But, for example, Telefónica might act as sort of a de facto issuer, working through a bank, yet taking a cut of the interchange fees, which are largely paid by merchants through their acquiring banks.

If so, that would apparently be different from the deal Telefónica’s UK branch, O2, has made with Visa and issuer NatWest bank for the cobranded O2 Money card, launched last year.

For that card, like a cobranded card rolled out this year by UK credit card issuer Barclaycard and mobile operator Orange UK, the issuing and acquiring banks benefit from the merchant transaction fees. A source said that Orange collects a fee from Barclaycard for each cobranded credit card the bank issues, a fee that is not based on transactions. The parties, however, have not discussed their revenue-sharing deal publicly.

Usually the transaction fee mostly belongs to the issuing bank, noted van Eldik. “But what we have done, in this case, is that we have negotiated an arrangement with the Visas and MasterCards, as well as we are currently tendering across our footprint for an issuing bank, where we take another slice of the dice,” he said. “And normally the issuing bank will take that from the Visas and MasterCards.”

Tapping Remittances
Telefónica, one of the world’s largest mobile operator groups with 264 million subscribers in 25 countries–many of them in Latin America–is also interested in mobile remittances, said van Eldik.

Globally, remittances amounted to more than $400 billion last year, according to the World Bank and usually flow from rich to poor countries. Both the senders and recipients of the funds transfers usually use third-party payment service providers, such as Western Union or less-formal schemes.

“If you see the pockets between Spain and Latin America, or you see between Germany and Turkey, or you see between the UK and Pakistan or Eastern Europe, there’s a massive amount of money to be made,” he said. “Nothing stops us as mobile operators.”

MasterCard and Visa are also trying to grab a piece of remittances, including those initiated or completed on mobile phones.

Visa Europe is a bank-owned card network, which is affiliated, but separate from U.S.-based Visa Inc. Like MasterCard, Visa Inc. is publicly owned. While it’s unclear whether Visa Inc. is in talks with Telefónica, that is likely. And as van Eldik and other observers note, Visa and MasterCard are acting more and more independently from banks. Still, any direct talks between telcos and card schemes would break the mold.

“This could be significant as this means that mobile network operators would be dealing with payment schemes at a higher level than just dealing with individual financial institutions,” Tim Jefferson, head of UK-based mobile and IT consulting firm The Human Chain, who moderated the WIMA session, told NFC Times.

Possible Negotiations for Phones
He added that any agreement between a big telco group and payment card network could possibly unclog the pipeline through which NFC phones are now only trickling out. A lack of agreement between telcos and financial institutions over how to share revenue from NFC-based mobile payment is one of the main reasons operators have failed to place big orders for phones the past couple of years, most observers agree.

“The combination of mobile network operators, scheme operators and handset manufacturers working together to produce NFC-enabled handsets is a much more attractive proposition," said Jefferson.

Any agreement with Samsung for multiple NFC phones would require a commitment for orders from Telefónica. It’s not clear what role Visa would play in that process.

At present, there is only one NFC phone available that is not a prototype and can support payment and other applications on the SIM card with a standard single-wire protocol connection with the phone’s NFC chip. Telefónica is using the model, the Samsung S5230, for a large trial planned for May in Spain. The telco likely would insist on SWP-enabled phones for any rollouts of NFC services.

Unwelcome by Banks
Any move into payments by Telefónica, of course, would not be popular with banks. And Jordi Guaus, head of mobile payment for la Caixa, one of Spain’s largest banks, told NFC Times he knows of no such move by the telco, at least in Spain.

La Caixa is working with Telefónica on a large NFC trial planned in the town of Sitges, near Barcelona, in May. The trial will involve about 1,500 customers and 500 merchants, and the bank has agreed to pay Telefónica to rent space for its payment application on the telco’s SIM cards. La Caixa is both the issuer and merchant acquirer for the trial.

“Telefónica is not taking anything of the (transaction) fee of the payment,” he said. “We have a commercial model, a (SIM)-rental model. For the trial, we are focused on learning and trying to test things and trying to define the process.”

There is not much room for revenue sharing of payment-transaction fees, said consultant Waqar Qureshi, formerly head of EMV card implementation at Visa International, now an advisor to telcos, banks and other service providers on payment.

“There’s not enough margin in the system,” he told NFC Times. “Nobody in the world has been able to break that business model down and create more participants.”

That might be why Telefónica is apparently considering taking on more of the role of payment issuer and possibly acquirer. It is not the only mobile operator attracted to the payment space. Telcos in Japan, South Korea, China and the United States have either launched their own retail-payment schemes or services or are considering doing so.

For Telefónica, the business models, however, will differ according to the country, van Eldik said.

At the same time, the Telefónica executive called for telcos and the financial-services industry to put aside their differences when it comes to rolling out mobile payment. If they don’t, they might find themselves left behind by more nimble players.

“We might all fight for a decimal percentage point to create our individual position, but I think the biggest threat is that that defensive play will be very time consuming and as a result of that, I think you will see the smarter guys like the Apples or Googles or whoever just sort of bypassing us relatively quickly,” he said. “We have seen that with the application stores, and if we’re not careful, we’re going to see the same thing with NFC.”

Consulting Smart Ltd provide specialist consultancy on the design and deployment of NFC technologies. For more information on how we can help your organisation realise the full benefits of NFC please see www.consultingsmart.co.uk or email Steve Beecroft, Smart Technologies Consultant on sbeecroft@consultingsmart.co.uk

Friday, 12 February 2010

How the Cambridge chip and PIN attack works

Cambridge University researchers have uncovered a major security flaw in chip and PIN, the UK's standard payment card system.

Chip and PIN uses a smartcard with a processor and memory to verify its own identity and that of its owner to a terminal belonging to a merchant. It is based on the EMV — Europay, MasterCard, Visa — protocol, and has been adopted practically universally within the UK for most retail card-based transactions.

The card itself runs part of the protocol on an embedded secure processor, meaning that certain secrets never leave it and are not readable from outside, no matter what.

In use, a chip-and-PIN transaction is started when the cardholder puts their card into a terminal. After verifying the card, the terminal asks for a short personal identification number, and when it receives a valid PIN, the transaction takes place.

There is no need for the card to leave the holder's control, making it very hard for dishonest merchant staff to steal details; and the PIN need be known to nobody but the holder, rendering a lost or stolen card of no use — unless EMV is itself vulnerable.

There are three stages to an EMV transaction: card authentication, cardholder verification and transaction authorisation.

Card authentication
Card authentication starts when the card is put into the terminal. The terminal asks the card for a list of applications it can support — there can be many different applications, with different keys, on one card. The terminal then selects an appropriate application and tells the card which options it wants to run.

Following that, the terminal reads the card details from the chip, which include account numbers, expiry date and information such as which methods of cardholder verification the card supports. There are also various digital signatures available from the card, depending on which variant of the protocol is in use.

Once the card has provided verifiable signed records and appropriate capabilities, the terminal is satisfied with its authenticity, and attention turns to the cardholder.

Cardholder verification
Cardholder verification starts with the card and the terminal negotiating what sort of verification is appropriate. Depending on a number of factors, including the size and nature of the transaction, the terminal picks one method from the Cardholder Verification Method (CVM) list previously provided by the card.

The CVM also specifies what should happen if verification fails: whether the transaction should be aborted or another method tried.

Most cards examined by Cambridge University security researchers in a hacking experiment had only three verification options: PIN, signature or no authentication. In theory, a terminal can tell the merchant to check the signature if the PIN fails; in practice, most failed PIN verifications terminate the transaction.

If PIN is chosen, the terminal asks the cardholder to enter the number. This is sent to the card, which compares it to its internal (and never revealed) PIN.

A match, and the card returns the hexadecimal code 0x9000. A failure, and the card returns 0x63Cn, where 'n' is the number of further attempts possible before the card locks up. However, the terminal does not authenticate that the response itself actually comes from the card it thinks it is talking to.

Transaction authorisation
Transaction authorisation follows. Here, the terminal asks the card to encrypt the transaction details, using various bits of data supplied by the terminal itself. The card can reject the transaction, or it can allow it — in which case, it generates a cryptogram that is sent to the financial institution.

After various checks on the card's validity, the likelihood of the transaction being fraudulent and there being enough credit available for the transaction, the institution sends back a response code telling the terminal and card what to do next, plus another cryptogram. These are sent via the terminal to the card, which checks them for validity.

The terminal then tells the card and the card issuer that the transaction is authorised, and keeps a copy of the transaction. At this point, it normally prints a receipt too, with details of the transaction and the verification method.

The Cambridge researchers' man-in-the-middle attack takes advantage of the fact that the real card does not know which form of verification succeeded, just that the terminal does not think that a PIN verification failed. The terminal does not know that the real card never received a PIN to verify, because the fake card in the middle issued an 0x9000 success code.

The terminal reports success; the real card assumes that was due to a non-PIN verification. Although the card may then report to the terminal that the verification was not via PIN, this is in a format that is not specified in the standard, so the terminal cannot tell.