Payments Security

From the Device to the Server: Google Wallet Simplifies Approach to Mobile Payments

Earlier this month, Google announced that consumers would have the ability to enlist their own financial card information onto their Google Wallet instead of waiting for their bank to board their card credentials. This approach supports the ‘consumer centric’ model for mobile payments vs. having interested parties such as banks, mobile network operators, etc. in control.

Dedicated security for mobile issuance

Next week I will be speaking at Cartes 2011 on dedicated security for mobile issuance together with Tim Richards from Aconite. If you’re at the show do come along to our session.

Mobile payments will soon become an important part of our daily lives. There are now more people with mobile phones than there are with bank accounts and that makes mobile phones a natural vehicle for payments. Juniper Research, a European based provider of business intelligence, released a study forecasting that mobile contactless payment transactions are expected to reach nearly $50 billion worldwide in 2014 and NFC solutions will be launched in 20 countries within the next 18 months.

Mobile wallet security

Over last few months various groups have launched their mobile wallet offerings.

In the U.S., Isis, the mobile payment initiative that AT&T, T-Mobile and Verizon started last November, recently announced plans to launch a pilot project in 2012. This project will create a payment network that enables customers to pay, redeem coupons and store merchant loyalty cards, all with the tap of their phone.

A huge stride to EMV in the US

Regular readers of this blog will know that I have been writing about eating the US EMV elephant for some time. Yesterday’s announcement from Visa may just be the big push the US market needs for it to finally migrate to EMV.

Visa’s roadmap includes ‘carrot and stick’ elements in its drive to accelerate EMV adoption in the US. Merchants will soon have an incentive to install chip-enabled terminals: When 75 per cent of a merchant’s transactions originate from chip terminals, that merchant will no longer have to go through the troublesome process of annually validating their compliance with the PCI DSS standard.  The twist for the US is that the terminals must be both contact and contactless chip enabled, while a similar programme in the rest of the world requires only at minimum that the terminals accept contact chip transactions.

New FFIEC guidelines make no mention of strong authentication

On Tuesday the US banking regulator, the Federal Financial Institutions Examination Council (FFIEC), set out its expectations to improve internet banking authentication standards. While the FFIEC calls for, amongst other measures, layered security and more sophisticated one-time cookies where device identification is used, there is notably no mention of strong authentication in their new document.

Strong authentication is already widely implemented in the UK and Scandinavia through the use of tokens and various devices to support card-not-present transactions such as Mastercard’s EMV-CAP card readers.

Security challenges in the age of mobile payments

It seems that the technology for supporting mobile payments will soon become widely available. Most of the major smartphone operating systems have announced support for NFC. Many big names such as Nokia, Blackberry and HTC have launched NFC phones and some key Mobile Network Operators have made announcements too. However, this new payment eco-system will present an array of security requirements and challenges.

Mobile contactless payment applications must be ‘provisioned’ before they can be used. ‘Provisioning’ covers the process of preparing and loading an application on a user’s phone with personalised account data. It also includes the deployment of unique personalisation keys to protect the loading of information to the device and the transactions made by the payment application.

Chickens, eggs and gorillas are red hot

The world of NFC and contactless payments is getting red hot.  The first month of 2011 has seen a slew of announcements and rumours relating to this topic.

I have written before about what I believe will drive NFC mobile and contactless cards payment forward. Well, many of them now seem to be well under way. Firstly, both contactless cards/phones with NFC and the terminals in shops need to be widely available (see The chicken and egg of contactless payments). Many card issuers have either already issued or in the last year announced they plan to issue contactless cards, and for phones, there are lots of rumours around Apple (see Apple: the 800 pound gorilla of mobile payments) and the upcoming Nokia E7 building NFC into the phone. There are even signs contactless terminals in shops are gaining momentum. McDonald’s move to equip all 1200 of its UK outlets for contactless payments could for example be a tipping point for the UK market.

So all is set for card schemes and issuers to corner the market for contactless payments. Right? Well maybe not. It seems there may be some truth to my previous prediction that Apple might blaze their own trail, with Bloomberg reporting Apple has already built a prototype payment terminal intended for small businesses. It’ll be hard for Apple to replicate the ubiquitous acceptance and usage that card brands have for payments, and that’s probably not their goal. Never the less, this does show that card brands will not be alone in trying to build a contactless payments network, and their competitor is one who  is already a trusted brand with a reputation for security, a prerequisite for widespread consumer adoption.

Steve Brunswick

Looking ahead to Cartes 2010

Thales will be at Cartes, Paris, once again this year at stand 3 B 035 between 7th & 9th December. At the show, we'll be discussing a range of topics from mobile payments to the latest industry regulation. payShield 9000, our next generation of payment Hardware Security Modules (HSMs) will also be on our stand for the first time at Cartes.

I'll be at the conference, along with my colleagues, Jon Geater, Richard Moulds and Jose Diaz, so feel free to drop by to catch up on industry trends and insights. In particular, we'll be discussing:

• Mobile payments - Next Trusted Channel or Fraud Frontier? As mobile devices continue to proliferate, they have become the next frontier for the delivery of financial services. But will the potential for fraud in this evolving delivery channel mirror that of other open environments such as the Internet, or will the lessons learned from current systems help shape the protection profiles used for this channel to enable us to capitalise on consumer confidence?
• Remote Manager - We'll be announcing a new version of our Remote Manager for payShield 9000 and HSM 8000 at the show. More information on this will be available nearer the time, so come along and see us to find out more. 
• payShield 9000 - Designed specifically to secure card payment systems, payShield 9000 is a high-performance tamper-resistant security platform that protects cryptographic keys and other sensitive information such as customer PINs and cardholder data.  The solution, which will be on the stand, helps the payment card industry deal with the current challenges it faces, from remaining competitive to supporting a wide range of new business offerings such as contactless cards and mobile applications as well as helping to improve protection for cardholder data.
• Trends in data protection and regulatory updates with a particular focus on PCI DSS and the latest updates in PCI 2.0. Copies of our dummies guide, ‘PCI Cardholder Data Protection for Dummies,’ will also be available on the stand.

Steve Brunswick

Apple: the 800 pound gorilla of mobile payments

To date, the poor availability of phones with NFC technology has been one of the factors holding back the use of this technology to enable wave-and-pay mobile payments in a shop or peer-to-peer payments by touching phones together. It seemed earlier this year that bridging technologies may provide the kick start needed for contactless payments to really take off, but now there’s another contender for moving things forward, and one that is renowned for ‘game changing’ the market: Apple.

The rumours around Apple’s  interest in NFC technology and mobile payments have been growing for some time now – filing patents, hiring product managers, working with Gemalto on SIMs (see appleinsider for numerous reports), and now they are alleged to be in a bidding war with Google for Boku . It seems increasingly likely that the “iPhone 5” will come with NFC built in, and some kind of mobile payments.  But what would this mean for the market? Smartphones are an increasing proportion of new phone sales. Apple is number 3 in smartphone sales behind RIM and Android phones, but they do grab the headlines, and other phone vendors seem to follow. So we could see all smart phones NFC and mobile payments enabled. Now that would move the mobile payment market forward. But I wouldn’t bet on Apple following the emerging standards. They seem to blaze their own trail and I expect they’ll want a piece of the transaction to fuel their burgeoning revenue.

Steve Brunswick

Contactless payments on the mobile - what is the standard?

One of the things needed for the market for mobile contactless payments to take off is a set of specifications financial services providers, MNOs and SIM/UICC and other vendors can work to.  This seems to be shaping up nicely now. Firstly, Global Platform pulled off a bit of a coup last November by getting the GSMA and EMVCo on board working on a specification to make it easier for any mobile payment application to work on any UICC. Now the EPC with the GSMA has issued "Mobile Contactless Payments Service Management Roles Requirements and Specifications".  In this document, the key management specification referenced for ensuring payment applications are securely provisioned and stored on the UICC are...wait for it...Global Platform's.  For purchasers and vendors alike, it’s so much easier when different organisations cross-reference common standards, and don’t go away and invent their own.

Steve Brunswick