Intro: Payment systems have transformed from simple processes like the clearance of a cheque to highly automated realtime clearance houses. Five industry experts analyze the scenario:
While payment system is loosely defined as a system enabling the transfer of funds between parties, today it has acquired substantially larger connotations and people often associate it with mobiles and mobility, wearable devices, realtime ACH, virtual currency, EMV, contactless payments and cloud-based payment vaults. It’s no more the simple processing of a cheque and collecting payments or a teller dispensing cash. It has become electronic – highly electronic. Technology is rapidly revolutionizing several many elements that constitute the payment process. For example, high speed data communication channels are now ubiqutous, computing devices are becoming more efficient and mobiles are really making the difference. Meanwhile, payment security and the protection of sensitive data, which are fundamental for any payment system, are challenged by dynamic, persistent and rapidly escalating threats. Added to this is the thinning of the international borders which results in demand for better and efficient payment options.
Mobile is one area which has indeed made a very conspicuous difference in the payments scenario. Says Srihari Bhat, group MD – Asia-Pacific of FIS, the international provider of banking software and tools, architecture and IT solutions: “Mobile is already the preferred channel in many markets and this will be true for nearly all markets in a few years including India and the rest of Asia. The access to the device implies access to financial services and payments, and financial institutions and processors recognize the benefits presented by mobile banking to consumers, institutions and even regulators.”
He says internet banking is evolving to being internet banking over a mobile device or simply mobile banking. Physical wallet replacement will happen once the entire payments ecosystem is able to support cashless and cardless transactions. This will happen eventually but is some time away for now. Mobile wallets will need to deliver on convenience, access, ubiquity, acceptance and security risk mitigation, he adds.
General Purpose
Peter Ollikainen, head, Product Marketing, Mistral Mobile, the Finland-based bank-centric mobile platform provider, says mobile is very quickly becoming a general purpose financial services delivery channel, whether it’s for banking, payments, lending and so on. “There will be a mix of ways for people to do banking and payments – all subject to situational and personal needs and habits. The bank branches have not totally disappeared as there is still need for occasional human touch, although the number of branches is becoming less all the time. Internet banking acts as a good self-service method for banking needs; and mobile banking will be the primary channel for the people who use their mobiles as the primary internet access device. Over time the distinction of internet and mobile will become totally blurred as people will be accessing internet service with all types of devices, many of which will be mobile,” says he.
According to Pradeep Kumar Sampath, COO, MMP Mobi Wallet Payment Systems, with over 90% reach of mobile and data penetration also growing among public, it is but a natural choice for financial institutions to look at mobile option to reach the customer. “Though it started sometime back with information being provided on simple non-financial transactions, with adoption growing on mobile based payments, other ecosystem players like eCommerce companies pitched for mobile commerce. Everyone wants get a piece of the mobile real estate of the customer. Also, it is extremely cheap to reach a customer on his mobile as compared to any other channel today available for the financial institutions. Finally, it makes sense to capture the customers’ attention on a medium where he spends most of his time during the day,” he maintains.
He predicts that mobile payments/commerce will leapfrog in years to come and we will definitely see a role reversal with majority of the transaction being made on mobile.
Investments
Vineet Anand, payment industry executive and formerly of Amex, Western Union and Digital Currencies, feels that growth in smart-phones, greater usage of mobile internet and threat from start-ups have forced financial institutions to review the digital paradigm shift and start making investments in mobile products and offerings to stay relevant. “This is part of the larger customer-retention strategy in embracing the needs of the digital customer today. Most financial institutions in US, Europe, Australia and other select countries have placed significant mobile IT spend investments in the past 12 months. This spend is leading to bringing more digital offerings to the delight of end-customer,” he avers.
He also mentions that networks like Visa and MasterCard are investing a lot into innovation initiatives like wallets, HCE, NFC, TMS, contactless, mobile POS, 3D secure solutions, APIs & SDKs to facilitate growth in mobile payments and contactless. “Growth in mobile banking is driving banks across US and UK to strategically disinvest in retail locations, and shifting that capital towards digital services.”
It’s Digital Banking
B. Krishna Kumar, a payments professional with more than a decade experience in p2p and merchant payments using emerging technologies, feels that it is no more mobile banking but it is digital banking. “Today, there are more people who have access to digital devices and the future also includes wearables. Financial institutions should have digital delivery as one if its core strategies – not only for transaction banking but acquisition too. Both the current generation and next generation expect the bank to go them virtually (at times physically). In the Indian context with the 20:1 ratio by which debit cards exceed credit cards, there is immense scope for processors to invest in direct debit (what is mentioned as mobile banking) as compared to card based authentication,” says he.
He is of the view that the bank/payment instrument is already on people’s mobile/digital devices. So its important to provide more and more avenues/applications which enable digital payment in the form of card/direct debit/wallets. “Wallets have an edge as there is 2FA requirement and also the risk is minimal as customers keep only minimal/adequate balance and top it up as and when required. Digtial wallets will replace both cash and internet banking,” he adds.
Security Issues
What about security perceptions in payment systems?
Srihari Bhat points out that information security risk today figures among the top priorities for any CIO whether at banks or large global fintech companies. “Risk and security threats continually evolve and so does the responses but the one thing which has remained constant is the increasing amounts of investments being made into meeting and countering information security risks. For example, there has been coordinated global response to card skimming in the form of migration to the chip and pin protocol globally including now in the US. This has significantly reduced global losses from card skimming. Adoption of multi factor authentication has seen reduction in effective hacks of online banking systems as gaining access to compromise passwords is no longer enough for hackers to gain access to online banking accounts. Risks to information security will be ever present and needs to be addressed on an ongoing basis through sustained investments and innovation,” he says.
Technological advances can be either proactive or mitigate (reactive) in nature to take care of possible security threats, says Krishnakumar. These measures can be both voluntary in nature and imposed by regulations, eg tokenization or biometric authentication by issuers/acquirers and mandatory 2FA by regulators. The latest threat perceptions are identity theft and also loss of authorization devices which today are mobile phones containing virtualized card information. Mitigants are quite effective in terms of device access security, remote device locking and data erasing and in cases of biometric access to devices, the devices are rendered useless, he elaborates.
Ollikainen of Mistral Mobile believes that no matter how advanced systems, there will always be security threats. “The human side (e.g. administrators, users etc) of any system is always the most vulnerable part, and that’s what will hackers continue to exploit. But increasing the security levels and risk-detection mechanisms are also required, especially for mobile payments as they continue to grow and hence become more and more interesting for hackers to exploit.”
According to Sampath, transaction level security risks are greatly minimized by the two factor authentication and some new technologies that are coming in this direction – voice based, biometric authentication etc. “On the backend infrastructure security there are still risks involved even with standards like PCI and one has to be mindful of that. Also as the digital payments explode, we need to also watch out for internal security compromise and every organisation has to have a risk framework and mitigation plan should such a risk arise,” says he.
No One Silver Bullet
There is no one silver bullet to address the security threats and its challenges in the increasingly complex payment system scenario, feels Vineet Anand. He says cyber criminals are more organized and sophisticated then ever constantly seeking for single points of failure to hack retailers and financial institutions. “For more than a decade, EMV, Tokenization and Point-to-Point encryption technology solutions have prevailed. However, organizations have been slow to adopt or chosen to ignore these solutions… As merchants embrace omni-channel strategies across retail, online and mobile with engineering teams building for EMV, Contactless, Loyalty, and other proximity marketing capabilities for a great customer experience, there are more opportunities for hackers to intrude into the network,” says he.
He points out that Apple Pay, one of the most secure mobile payments solution with every 2 of 3 mobile transactions in US, was impacted by fraud estimated at 6% transactions processed. The issue centers on a process flaw at the time of card registration to authenticate the identity, and verify the card holder executed by card issuers.
“Organizations accepting payments especially those that hold customer financial data need to have a security strategy that compliments the technology architecture,” says he, adding, “Protecting customer financial information at all points of customer purchase retail journey will require a bundle of solutions including 3D Secure (EMV 2.0), two-factor authorization, biometrics like Apple iTouch, EMV, tokenization, point-to-point encryption, firewalls, packet inspection, DMZ’s, and intrusion detection sniffers to constantly monitor the network. The current pace of developments will require an ongoing review of effectiveness of solutions and tools deployed to thwart malicious intrusions.”
Contactless
There is lot of talk about contactless payment system. Has it evolved? What are its merits – and demerits?
Krishnakumar is forthright: “The merits are for everyone. The customer doesn’t part with his payment instrument, the merchant still continues to initiate the transaction, the check-out experience is both convenient and quick. If the transaction requires 2FA, there is PIN or token authorization else its a breeze. It helps in queue busting and faster service. The challenges are issuance, acceptance and adoption. Issuers feel NFC-enabled cards are expensive to issue, there is no adequate acceptance infrastructure by acquirers and adoption will take time. Acquirers feel there is not enough issuance to justify investment in acceptance infrastructure. Its a classic chicken-egg problem. But the success of the likes of Applepay and inter-operable payments like Octopus in Hong Kong, have given enough insights and learnings for others. I feel contactless inter-operable (transit, merchant payments etc) can become the preferred mode of payment. The inhibitions were in the past, the insights are in present, future looks bright and big for contactless.”
Srihari Bhat says contactless payments have been gaining momentum and with the recent addition of contactless support by the major handset producers like Apple and Samsung, this momentum will only gain pace. “Contactless card programs are doing well globally including in Asia. With the ability to merge the payment mode with the mobile device, it augurs well for the growth of contactless payments. Adoption will be fastest in the more advanced payments markets such as U.S., Japan where such payments are already popular. As well as in markets where people have the ability to use the contactless cards or devices across retail and transport purchases,” he maintains.
On the merit side is that it is a simple and user friendly transaction which is far more secure and it has the right reasons for it to become the preferred mode of payment, says Sampath. However, it requires the merchants and payment companies to adopt a new technology and recreate the ecosystem which is complex and also there are far too many options available like NFC, QR Code, Simple SMS based transaction etc. This makes it even more difficult as there is no standard and if the same merchant has to support different transaction type then it adds to his complexity and overheads.
Driven by NFC
Vineet Anand says contactless payments growth is driven by NFC cards and mobile phones. The most successful contactless payment is Starbucks wallet driven by bar/QR code. The thirst for coffee at Starbucks is driving 7 million transactions a week with nearly 16% of total Starbucks payments now executed using QR code, says he. “Starbucks QR code success is likely driving CurrentC (MCX) in preparing for a launch using QR code and loyalty program with its 50 participants including big retailers Walmart, Walgreens. Best Buy, Dillard’s and GAP.
“In the next 5 years,” he says, “I believe there will be a significant adoption of contactless in US, Europe, Australia and New Zealand. Countries in Asia will continue to experiment, leverage successes from first wave of adoption countries with varying success. US growth will be fueled by merchants having migrated to EMV and contactless terminals and the customer experience driven by likes of Apple Pay and Samsung Pay. Gen X, and millennial’s are embracing mobile at a faster pace than previous generations. They are at ease today to use mobile for P2P payments with providers like Venmo for number of use cases including splitting bills, sharing room rents, extending credit to others. Gen Y and Baby Boomers will slowly transition to mobile payments at POS in a follower phase.”
He also quotes Berg Insight estimates to say that by end of 2014 approximately 9 million POS terminals accept contactless, which is triple the 2.6 million terminals with contactless features in 2012. Data from UK card association indicates a record 2.32 billion contactless in 2014, three times the spent from previous year. London Transit system is receiving millions of transactions per week, which are all contactless.
Ollikainen feels contactless have the benefit over traditional Chip and PIN and magstripe systems as it can be implemented using various types of devices like wearable gadgets, mobile devices and so on. However, it will require the shift in the habits of the consumers – they are used to paying in certainw ays and adopting new ways will always take time.
What are the new frontiers of the now almost ubiquitous POS terminals? Is the technology marching ahead corresponding to advances in payment systems like NFC, like mobile wallets, like contactless payment system?
To Mobile POS
Sampath says it is a bit too early to comment. “But quietly the traditional POS is undergoing a change and is being replaced by the mobile POS. Any other development is clearly hinged on the technology which is going to take center stage,” says he.
Krishnakumar says it is bound to see developments. “If the plastic card can make way to a wallet/virtualized card, the POS needs to be both tuned and ahead for acceptance. The Hard POS for CP transactions and Soft POS (Payment Gateway) is a reality and already exists in rest of the world. The right use case, scalable and viable business models will bring them. A lot of POS (except very old legacy ones) are already hardware enabled for NFC/Contactless payments. The application on the POS needs to support NFC/Contactless and the emerging regulatory guidelines on it,” says he.
Srihari Bhat sees a healthy future for the physical POS. “Greater acceptance of cards will drive the growth of physical POS deployments, whether traditional devices or mobile POS solutions. Specialist solutions are now needed rather than the legacy POS solutions that serve different market segments. For instance, mobile POS devices will work well for micro merchants, or electronic commerce providers who accept card payments on delivery. Physical devices will remain prevalent for mainstream commerce and merchants, or use at petrol chains for instance. There is space for growth of cloud based POS solutions now to serve specialist needs, but security is a critical issue to be managed,” he adds.
Ollikainen belives the ubiquity of POS is still not there fully, especially in the rural and even semi-urban areas in many of the markets, as these areas can be suffering from lack of internet connectivity and mobile data connection availability. With mobile POS device, the distinction between what a POS device does gets very blurred as the mobile can include so many other financial servicing applications, he says, quoting the example of how a mobile device can be a combined mobile teller for deposits and withdrawals, payment device supporting card-based payments and money transfer service. “This is most visible in the agent banking services which are using mobiles as the agent servicing tools.”
Mobiles & ATMs
Do they see a synergy between mobiles and ATMs?
Definitely yes, says Sampath. “There could be synergies that could be worked provided the regulations allow those. However, from a customer stand point it would be a cool idea for a customer to walk into an ATM and punch in his mobile number and mPIN and an OTC to get cash and walk out,” says he.
Krishnakumar affirms that a synergy already exists – “in terms of transaction confirmation and also transaction authorisation (cardless cash withdrawal). There can be more in terms of offers eg coupons on mobile to make the customer aware of deals in the neighbourhood as the transaction /enquiry is made at an ATM.”
Srihari Bhat cites how FIS brought to market a technology which allows customers to use their mobile phones to preorder cash withdrawals from ATMs and subsequently use their phones to get instant cash withdrawals from the ATM without using their bank card. “This elevates both the convenience and security elements of using the ATM. We already see the interplay between ATMs and mobile phones become even stronger. For instance the use of mobiles for authentication with or without using the card at the ATM or the ability to send mobile transaction receipts instead of paper receipts generated at the ATM, which is both environmentally friendly as well as allowing faster use of the ATM.”
Future Of Bitcoin
Finally, how will the concept of virtual currencies fit into the evolving payment system scenario?
Vineet Anand, who has actually worked in th crypto currency domain, feel that virtual currencies like bitcoin are a solution seeking for a problem to solve. He says statistics indicate that over 95% of transactions in bitcoin are used for speculative trading by investors and that trend is evident during currency fluctuations representing a spike in volumes from an average of around 90,000 transactions every day. “For merchants accepting bitcoin, it will very unlikely generate new customer acquisitions in big numbers. However, it presents an opportunity to PR their websites and mobile applications driven by euphoria by the bitcoin enthusiasts. This has led to large companies including Overstock, Dell and Microsoft to accept bitcoin currency. One of these companies is providing bitcoin usage metrics and that confirms my belief that retail customers are not ready to use bitcoin for eCommerce in most countries.
“Technologies like Bitcoin and Ripple are driving a conversation for change across the globe for faster, cheaper and secure payment,” says he, adding “SWIFT like institutions are feeling that heat and have begun exploring options; real time payment systems are emerging – FAST in Singapore, Faster Payments in UK, Sweden, now Australia is working on its initiative and US ACH is reacting too.”
He states that for merchants this is great news to access faster, cheaper and real-time settlement for domestic transactions; growth in P2P models like Pingit and Venmo or small businesses; cross-border payment costs will reduce in countries with real-time payments for B2C; SWIFT costs will reduce; remittance costs to popular corridors will fall significantly. All these changes are part of conversation driven by bitcoin and for countries like Venezuela with high inflation, bitcoin will be a safer haven provided there is liquidity.
Anand also believes that Block-chain technology, which powers virtual currencies, will in the next 5 years change the way we write assets today, potentially leading to disintermediation of some products offered by financial institutions today. “Innovation in this space has begun and new business models are emerging with VC funds. Recently published Goldman Sach’s research indicates 33% of millennials believe they will not need a bank account in 5 years. In addition, from a social perspective it will remove dependence on a handful of trusted parties to manage records which form an important part of our lives.”
Ollikainen is of the view that virtual currencies will become just another form of payment over time, having certain benefits over traditional currencies (such as simple cross-border transfers, no charges on the transactions etc) but at the same time risks as well (exchange rate fluctuations and potential manipulations, and problems on any recovery from fraud and theft due to anonymous nature of the cryptocurrencies). “They will become a one form of value complementing other forms of value such as traditional currencies and gold.”
Sampath too says the world will move over to virtual currency slowly as bitcoin has shown the initial path and regulators looking at this keenly to see how this could be leveraged to enable large payments between enterprises and customers.
Digital currencies like bitcoin becoming alternative currencies will largely depend on their acceptance by the regulators, says Srihari Bhat. “That in turn will depend on how reliant digital currencies appear to be as both a store of value and medium of transacting value, which at the moment is a challenge given the spate of incidents of hacking and bankruptcies associated with digital currency operators. The use of bitcoin for illicit purposes such as gambling and money laundering etc also doesn’t augur well in the short term. There will no doubt be more developments in this space, and only time and the view of global banking regulators will tell on how bright the future of digital currencies will be ultimately,” he says.
Krishnakumar affirms that the role of virtual currencies is definitely important in the emergence of cash less payments. But he says it is important that virtual currencies are backed by real value and made stable and secure and they adhere to KYC and AML guidelines. “The chequered past of the likes of bitcoin (Silk Route issue, some of the exchanges going bust and the immense volatility) has resulted in knowing the weaknesses and thankfully the issues are being sorted out for better now. In hindsight, RBI has kind of insulated India against the risks of such virtual currencies. We should have a relook once risks associated with it are adequately mitigated,” says he.
