blog

The Security Conundrum – Part 1: The Puzzle

Tue, 20 Apr 2010 18:24:00 -0400

In recent weeks I have picked a number of conversation threads on the on-going difficulties of securing transactions, such as the recent PYMNTS.com posts of Mohammad Khan and Jack Jania or the ANSI X9 call for new standards to secure debit transactions.

Since the breach of Heartland Payment Systems, a certain malaise dominates the question: one can’t overlook the expenses incurred to achieve PCI compliance and question what’s next. Yet, somewhat surprisingly, the conversation on transaction security continues to revolve around some magic silver bullet. PCI, encryption, tokenization, dynamic data, EMV, CAP… the litany of product proposals if as long as the list of end to end strategies is short.

In this two part commentary I will take a look at the growing challenges of securing payments, and some of the creative thinking I have recently encountered.
The importance of securing transactions is as old as commerce. It is not just a question of fraud losses but also one of trust in the system. As the 19th century American politician Henry Beecher stated “commerce dies the moment, and is sick in the degree to which men cannot trust each other”. From the perspective of consumer trust, transaction security is critical to merchants and bankers alike, which is neither lost on the regulators nor the litigators.

In the last ten years though, maintaining trust in the payment system has become an ever more complex exercise of guerilla war between payment service providers and criminals. Prior to the advent of e-commerce and the internet, fraud was mostly concentrated on lost & stolen, and counterfeit attacks. Counterfeiting was as much an art as a science, as demonstrated by the simplest form of skimming which involved rubbing two cards slowly against one another.

Today, the threat surface has increased exponentially as a function of the evolutions of commerce beyond face to face transactions, carried over ever more diverse infrastructure elements. If the exposure equation is a function of threat-counts times vulnerability times impact, one can easily appreciate the security conundrum faced by payment systems:

1. The variety of devices is exploding:
Long gone are the days of cards and POS owned and deployed by the financial institutions. From PCs to mobiles, to kiosks, to off premises ATMs, to SD cards… the ever increasing number and variety of commerce enabling devices makes it difficult to manage their compliance with security standards developed by the payment industry. To put it in perspective, compare the fewer than 100 EMV chips certified by the payment networks, to the more than 2000 models of mobile phones currently in use in the world. While attempts have been made to simplify the problem thanks to Trusted Security Modules embedded in consumer devices, issues such as the lack of standards on secure hardware and middleware, or the difficulty to maintain the audit trail throughout the supply chain are currently limiting their applicability.

2. Transaction types are multiplying:
Lifestyle evolutions along with new technologies have lead to a variety of changes in payment acceptance. Beyond MOTO and e-commerce transactions, witness the growth, of unattended terminals from gas pumps to supermarkets; of micropayments aggregated to payment cards or third party bills themselves settled through secondary payment transaction; of person to person payments; or of cross border transactions in professional online marketplaces... Each present different risk management profiles which have lead to patchwork of payments services

3. Authentication methods are bifurcating:
The growing number of card payment use cases has lead to a fragmentation of the authentication landscape. As I prepared this post, I used my Amazon password here; my iTune password there; my Verified by Visa PassCode from time to time; my CVV2/identity code more often; my zip code at the pump (fortunately I don’t live in Canada and fill up in the US!) and my address at a catalog merchant; my PIN at the ATM and merchants where I forgot that a CheckCard is a credit card; my email address for ACH transfers; and even parts of my card swipe at airports check-in counters. Throughout, I left a contrail of identity and account telltales providing the criminal mind with as many potential attack vectors on the system.

4. Payment data is used in a growing number of applications:
Repeated industry studies since the CSSI breach have shown how the shadow of payment data extends far beyond payment applications. Loyalty applications transforming transaction information in points, behavioral segmentation and other targeting tools are the most evident examples. Authentication and age verification, T&E reservations systems are but examples of multiple other instances, many outside of the control and the knowledge of the payment industry.

5. More delivery intermediaries are participating:
Once upon a time a card would get swiped at a standalone POS, which dialed up an acquirer system for entry into the secure world of the payment networks. Alas these are times are gone. Witness the TJX case and the vulnerability of the in-store/in-chain network; or map the many hops that card data will make in a Tier 4 e-commerce merchant, through a checkout provider, possibly to an ISO and acquirer, but also a fulfillment agent, a third party customer service provider and why not, a combined loyalty program. Controlling the devices, network, applications and processes of each of these suppliers is a task of Herculean proportion. While PCI attempted to solve this, its cottage industry has itself become part of the equation as the Heartland case so aptly showed.

6. Cost of compromises is escalating:
Beyond the cost of fraud, lies the cost of compromise management. Industry analysts estimate that single digit percentages of compromised accounts are actually used in fraudulent transactions. Nonetheless , issuers are put in a position of having to remediate all of theses accounts. Reissuance, tighter authorization controls, compliance with identity protection laws and regulations don’t just create direct costs, they also seed doubt in the minds of affected consumers, drive up customer services calls and costs, and impact activation and usage of affected accounts. One industry source recently told me the incremental cost of managing a compromised account was as high as $8 / year.

7. Attackers are becoming increasingly sophisticated:
20 years ago, card fraud was largely an art. Today it is a science and a business. Hackers gathered information from TJX for close to 2 years before accounts were used for fraud. Around the same time, fraudsters installed professional grade skimming devices on ATMs in Canada. Criminals are also known to have created online market place for selling and trading compromised accounts. In the UK as EMV cards were deployed fraud shifted rapidly to online and cross border transactions. It is not that the payment networks have not labored to build their own set of tools and technology – witness the sophistication of neural networks and real time scoring systems – but that would be attackers can ever more easily get access to knowledge and technology to carry their deeds and are often organized in complex rings.

If your head is spinning, welcome to the club, where more than one Risk Management executive live, wondering what next “surprise” will cost his or her job. Not long ago Sun Tzu’s “The art of War” was a source of inspiration to business strategists. I would suggest that guidance for securing transactions may well be found in military writings on counteracting insurgencies. Fifty years ago Sir Robert Thompson, the father of modern counter-insurgency, described how only holistic strategies could countermand guerilla warfare. Translated into our context, this would means conceiving not only new technologies but also economic incentives, legal and regulatory tools, cross industry collaboration, public-private partnerships, empowerment of consumers and merchants, tied together with a heavy use of intelligence/information systems. The investment is anything but trivial. However this is not an academic issue: as the iPad’s growing number of novel apps suggests we continue to barrel down the path of an economy of bits and bytes. Securing electronic payments is fundamental to our future growth.

In my next post I will compare and contrast in that light various proposals for securing payment transactions.

Agree / Disagree ? : Contact me at patrick.gauthier@faultlinecommerce.com or twitter/PRGauthier
Patrick Gauthier, is a payment industry executive with 20 years of experience in developing, selling and deploying around the world, new technologies for payment and commerce, most notably as Senior Vice President, Innovation at Visa International. He currently a provides management consulting services on mobile commerce and e-payments.

The "New and Improved" PayPal

Fri, 26 Mar 2010 08:00:00 -0400

Recent announcements show how PayPal is taking on the mantle of Innovation Leader in the payment industry

Last week was again rich in announcements for PayPal with the launch of a new Bump-enabled iPhone application and a strategic agreement with China UnionPay. As I mused over both, I started to assemble a broader view of the transformation of PayPal as it has been playing out since last September, pointing out to a marked shift in the center of gravity of payment innovation.

At a time when the industry is buzzing about new comers such as Square, it would seem counter-intuitive that the "venerable" PayPal, born way before Web 2.0 was coined, would be leading the innovation wave. After all, in September the company added seasoned executives from Citibank and Wachovia to its management ranks, and, Scott Thompson is a Visa alum, each of these relativelly prudent companies. Nonetheless, the recent string of announcements is unprecedented in the payment industry by their breadth, impacts and ambitions.

As an appetizer, last November PayPal launched PayPal X, opening its authorization platform and account management platform to third party developers. PayPal X, a first in the payment industry, is forcing all major platforms to rethink their ecosystem strategies.
In an interview in January, shortly after signing deals with S1 and Fidelity National Information Services, Scott Thompson identified collaboration with Banks as a key strategic direction, to the point of willingness to subordinate the PayPal brand with a "Powered by PayPal" approach.
In February, PayPal and Facebook inked an agreement to integrate PayPal payments with the platform of the social network behemoth. Shortly after, Facebook overtook Google as the most visited online property.
Last week, just as Citibank was expressing doubts about person-to-person payments, PayPal reaffirmed its belief in the opportunity by introducing a new iPhone app including the proximity solution offered by Bump.
As a the piece de resitance, PayPal and China UnionPay signed last week an agreement to enable Chinese consumers to use PayPal to pay for e-commerce purchases globally.
And for the cherry on the cake, PayPal announced the results of its Developer Challenge at one of the most coveted innovation conferences — DEMO.

Across the board, PayPal is demonstrating out-of-the-box thinking in platform, branding, commercial agreements, and technology, each with significant growth implications for the company. The China UnionPay announcement merits a special note. China – now the second largest economy – is largely a virgin market for the global payment brands, and has been coveted for a long time. However that is not to say that China UnionPay should be discounted as a minor player. With more than 1 billion cards issued, and a network with switching capacity that rivals that of Visa, China UnionPay is a formidable new player, who has been vying for a global position. As Thompson remarked e-commerce originating in Asia is a fast developing opportunity and this deal puts PayPal in a very enviable position.

It is interesting to compare this string of announcements with that of the rest of industry in the same timeframe:

American Express acquired Revolution Money, acknowledging that it was motivated by building a platform and acquiring competences in e-payments.
MasterCard continued to develop its MoneySend and PayPass platforms, and released an ATM hunter application, all in line with multi-year efforts.
Visa launched Rapid Alerts, inked a partnership with startup Device Fidelity, and pre-announced an e-commerce wallet reminiscent of Brodia's offering a decade ago.

So, what might be driving PayPal and what does it mean for the traditional industry?

First there is a question of size: Last year PayPal cleared $71B of transactions. And while making it a payment solution of choice for e-commerce, it is little in comparison to the big payment networks. Consequently a $10B volume opportunity which would be a rounding error for traditional networks is a great growth opportunity for PayPal which will act accordingly. PayPal's established competitors should consider carefully their market share on-line and the long term implications on share of payment volume as traditional POS infrastructure and online infrastructure converge.

Second, one of the most enduring Silicon Valley rumors anticipates that PayPal should go public in the not too distant future. It would certainly stand to reason: PayPal is now an established brand, and its trailing revenues compare to that of MasterCard at the time of its IPO. If the innovation profile of the company and therefore its growth prospect is elevated, it could command multiples comparable to that of other payment networks. Using Visa's enterprise value to sales ratio as a goal post one could assign PayPal a market value in the order of $25B. This is bound to attract talent to the San Jose company which other payment brands can anticipate as demonstrated by the recent hiring by Visa of Bill Gajda.

Third, most important when considered in the context of calls for interchange regulations, PayPal changes the four party model in significant ways. If one compares the impact of interchange regulation in Australia on Visa/MasterCard issuers vs. American Express, it is clear that closed/semi-closed loop payment systems may have an inherent advantage. In partnering with Banks, and why not sharing in the top line opportunities, PayPal could seriously affect the balance of the eco-system. In that light rethinking the services offered to banks to assist them with new payment and commerce channels is a critical imperative for the rest of the industry.

Last, innovation is a matter of culture: PayPal is grounded in the advent of E-Commerce and Push Payments both permitting changes as radical as the introduction of the Association model did… four decades ago. This not only explains best why PayPal would try where other would shy away, it also exemplifies the challenge for leading providers. It would be reckless for a Visa or MasterCard to try become an Internet-style company. However, they would be well advised to aggressively partner with other new comers such as Obopay, or Bling Nation to capitalize on their "let's do it" outlook on business.

Agree/Disagree? Contact me at patrick.gauthier@faultlinecommerce.com or twitter/PRGauthier

Patrick Gauthier, is a senior payment industry executive with 20 years of experience in developing, selling and deploying new technologies for payment and commerce, on a international basis, in private and public companies ranging from start-ups to global organizations.

Is Visa Becoming Serious about Mobile?

Wed, 24 Feb 2010 17:18:00 -0500

Visa's appointment of industry veteran Bill Gajda is an important signal, but structural challenges to innovation will have to be addressed.

Ever since its Initial Public Offering prospectus Visa Inc. (NYSE:V) has made no mystery of the importance it thought mobile payments would have in its future. Yet, judging from its press releases over the last 18 months, the company was struggling to define and implement a vision of why and how. Interestingly, the only significant allocation of resource to mobile payments came from Visa Europe, which announced earlier this month its intention to invest 200 million Euros.

Far from me to belittle the efforts of the payment leader who finds itself caught in a classic innovator's dilemma. In general mobile innovation – not unlike web innovation ten years ago – had to start out of the mainstream payment industry, as was demonstrated by the likes of Paypal, the GSMA, Nokia, Obopay, Monitise, and, as recently reported by the NFC Times by top telecom operators.

The appointment of Bill Gajda marks a turn. It echoes the realization of the importance of mobile in the delivery of mainstream consumer services and highlights the importance of building business innovation more so than developing technology and pilots. I worked with Bill during my tenure at Visa and do believe his recruitment is a coup. Having been a force behind the GSMA's NFC and mobile money transfer initiatives, Bill brings a global perspective, a wealth of experiences and contacts, and the ability to open meaningful discussions with the executive suites of operators around the world. Furthermore, with the very structure of the GSMA mirroring that of Visa prior to its IPO, he should adapt rapidly to the culture of the organization, a critical success factor when trying to sell new ideas.

However, we shouldn't underestimate the challenges that he will have to face. Just considering the following should have anyone applaud Bill's courage:

> Visa, like MasterCard, makes a significant portion of its revenue through branding and transaction switching fees. Not so long ago the position of the brand on the front or the back of the card was a cardinal issue, and, Visa and FDC fought a legal battle over transaction processing rules. Yet in the mobile world the brand will have to co-exist with the equally powerful marks of the handset makers and the operators. Furthermore in an IP driven data infrastructure the very role of the network will evolve from switching to value add services.
> The payment industry's culture is steeped in the notion of "the card", as demonstrated by the "Card not present" denomination for e-commerce transactions. With handsets such as the iPhone, or the Droid embodying the electronic wallet of the future, many business processes have to be re-invented.
> The telecommunications industry has been far more adept at rolling out new infrastructure and services than the payment industry, as proven by the four generations of mobile technology deployed in the time payments technology was partially upgraded to chip. Energizing and motivating Issuers and Acquirers to move at a different pace is a formidable task in of itself.
> Mobile innovation was unleashed by the likes of Apple and Google, yet, possibly with the exception of PayPal and its new open platform, no such catalyst has occurred in the payments industry which is deriving much of its continued success from deploying more acceptance along with more debit and prepaid products.

Operators, handset providers, payment networks and banks, will all play a crucial role in the advent of mobile commerce. Bill has the diplomatic skills and the industry experience to bridge their differences and propel Visa forward. I wish him the best all the while looking for a spandex suit with a big "B" upfront. Now the question is, what will MasterCard and American Express do?

Agree / Disagree ? Contact me at patrick.gauthier@faultlinecommerce.com or twitter/PRGauthier

NFC: Past, Present and Future

Tue, 16 Feb 2010 08:00:00 -0500

The announcement by the GSMA and its partners of another NFC demonstration pilot highlights how Near Field Communication is caught in the "trough of disillusionment." Commerce innovators shouldn't despair, the future is bright.

What a difference a couple of years make! During CES in 2008, visitors were treated to a variety of demonstrations at the "NFC Zone" where they could experience the power of simplicity NFC style. Yet, at last's month edition of the consumer technology pilgrimage, NFC seemed to stand for "Not Found at this Conference." What happened? Is it just the financial crisis, something more profound or the natural growing pains associated with a disruptive technology?

To first gain the proper perspective, it is useful to look back.

Sometime before the collapse of the internet bubble, executives from Nokia, Sony and Philips Semiconductors started to anticipate the evolution of mobile devices from telephony towards commerce. In particular, Dr. Karsten Ottenberg (then head of the Philips Semiconductors' Identification Business Unit, now CEO of Giesecke & Devrient) evangelized a number of use cases such as peer-to-peer money transfer, ticketing and payments at the point-of-sale, which successfully demonstrated the simplicity, speed and security afforded by NFC transactions. Contactless technology was not in itself novel. It had been pioneered by such companies as Mifare, Gemplus and INSIDE Contactless for transit or product tagging. Yet, the vision behind NFC was bold: mobile phones were poised to become the wallet of the future, truly. It spoke of new and better customer service, higher revenues and retention for merchants, operators and issuers.

By 2002, MasterCard, under the leadership of Art Kranzley, saw the potential of contactless payments and NFC to capture everyday spend. Following a successful pilot in Florida, MasterCard started testing proximity payments with Nokia in Dallas. Consumer reactions were positive and the initial technical assessment proved that NFC did work at the same point-of-sales as contactless cards. In a sign of merchant interest, McDonald's was enticed to deploy contactless acceptance as part of their U.S. terminalization program. Other pilots – such Citibank's trial with the New York subway – seemed to confirm the potential for differentiated issuer offerings. In parallel, Cassis and Venyon demonstrated both the technology and the business models for over-the-air provisioning of the service credentials. By 2005, Visa, MasterCard and American Express launched contactless payments initiatives in the U.S. and around the world. Within 18 months, the last missing piece of the puzzle, commercially available NFC handsets seemed destined to happen.

So, where did we miss a step? Today, in spite of the user appeal, the technology convergence, the collaboration between industry giants, and the successful tests around the world, NFC has stalled. As the American Banker recently remarked, there is "Lots of Talk about NFC Payments, Little Progress". There is no denying that the financial crisis has had an important impact. Innovation is not the first priority when revenues fall sharply and the foundations of one's business are crumbling. It would be too easy though to pin it on the economy and several fundamental problems remain:

The economic buyers – i.e. the Mobile Operators and Issuers – have not solved their rivalry: Behind the scene a furious battle has raged on the ownership of the secure element used to secure transactions, a proxy for the question of who will own the customer relationship. Operators, looking for new revenues in the face of eroding growth in their core businesses, are championing the SIM card as the only acceptable trusted element, a position difficult to endorse for issuers and potentially regulators. Absent agreements on the roles and responsibility of each – from acquisition to customer support and risk management – and the associated revenue streams, the individual stakeholders are challenged to build a positive business case for the deployment of NFC. In fact, a closer examination of the early excitement around NFC finds that innovation divisions are chiefly involved, and that core business units still don't participate. Notwithstanding the enthusiasm of the NFC champions, little of the debate and energy was focused on the consumers' needs, as is often the case in the early stages of new technology. Thus, despite the buzz, NFC hasn't crossed the chasm from Innovators/Early adopters to Mainstream buyers.
Consumer have good enough methods of payments as it is: Without prejudice for the vision behind NFC, the need for a new method of payment delivery based on handsets is tenuous. The top justification for NFC is that more consumers have phones than cards, and that for most of them the phone plays a more important role in their daily life. For consumers though, payments demand first and foremost simplicity, trust, extreme reliability and streamlined costs. In that context cards are hard to beat as a payment token especially when enhanced with contactless interface. While handsets with NFC provide a potentially richer consumer experience, in most cases they also add complexity such as downloads, and clicks, and selections ,and PINs… to name a few, which limit their appeal for the common user. Furthermore for Financial Institutions, NFC introduces major changes in the accounts' lifecycle along with associated expenses and operating risks, without a definitive incremental economic value. Absent a reason for consumers to want it and a business case for Issuers to support, standalone payments is an unlikely "killer application."
No good path has been proposed to reach a critical mass of users: If I had a penny for every time I have heard about "the-chicken-and-egg" problem, I would be retired by now. Cliché as it is though, it is true that without a critical mass of users and acceptors NFC payments will not take off. The business model issues are compounded here by the number of handset models available in the market and the factors that influence the selection of a device. Consumers chose their handsets principally as a function of the content and services they enable. With a small number of mobiles offering NFC, and unclear use cases, it is difficult for consumers to get excited about the functionality. Given the incremental bill of material of $3 to $5, it is equally difficult for the handset manufacturers and their clients to justify the expense across the billion or so handsets shipped every year. Considering the lack of success of co-brand cards associating Telecom providers and Issuers, it stands to reason that consumers do not select a bank as a function of their mobile service provider neither will they select a mobile operator because of their card issuer. Hence, it is unlikely that mass deployment of NFC handsets will stem from the ability to just pay at the PoS.

So, where do we go from here? I believe the path to NFC lies with rich integrated transactions. For a decade as they worked on the migration to chip cards, the payment networks elaborated the vision of "the relationship card" (aka the Super Smart Cards), a multi-application token that would simplify people's life by combining applications needed to integrate services at the point of delivery. As recently as 2000, the smart Visa platform combined payments, loyalty, couponing, and online authentication to facilitate commerce on line and at large merchants. The key challenge of the relationship card though was one of usability: with only a few lines of a PoS to interface with the users and the constraints of ISO 8583 connectivity to pass application data, the relationship card was extremely difficult to market and sustain. Mobile devices easily overcome these shortcomings and , as we move from a world of impressions to a world of engagement, there is not a marketer that isn't seeking to use mobile phones for relationship purposes. And the missing link is connecting the phone with the PoS, which NFC will provide.

Google now predicts a future where it will garner more revenues from mobile applications than the traditional Web, which echoes the insatiable appetite of consumers for "touch" devices with a broad number of "apps." As envisioned by the inventors of NFC, mobile phones have evolved far beyond telephony becoming networked devices fulfilling a number of needs to stay connected, informed, engaged with one's networks.

The adoption of iPhone-like devices continues to put strain on the wireless data networks which will justify embedding NFC for operators to satisfy peer-to-peer applications. After all, why clutter the network to exchange information between two persons next to one another? NFC in that perspective has a viral potential – call it the new "Friends and Family." In addition, merchant engagement strategies combining personalization, real-time information at the time of decision, and targeted promotions at the time of purchase call for a future that utilizes NFC not as a substitute for a card, but as the logical interface to bridge the gap between data networks and payment networks. Once again, electronic payments will deliver value for the merchant community by delivering the sale; issuers and operators will derive revenues from higher usage and reduced churn and new services provided around the use of mobile networks; and as for creating critical mass, accessories in the form of skins, and SD cards will provide opportunities to market NFC independently of the handsets to break through the background noise.

With that in mind, I hope that this week, as the Mobile World Congress pilot gets discussed, NFC will stand for "Nearly Found the Code".

Agree / Disagree ? Contact me at patrick.gauthier@faultlinecommerce.com or twitter/PRGauthier

Apple and the Dawn of i-Commerce

Thu, 28 Jan 2010 08:30:00 -0500

It will take a couple of iterations, but the iPad will open new frontiers for "e-transactions"

Yes, you read it first on PYMNTS.com, the new member of the commerce alphabet soup will be "i-commerce"! That's what I believe Apple really started yesterday with the introduction of the iPad.

Granted, Apple's announcement, given the amount of hype and anticipation was not overwhelming. In short we can say that the iPad is a big iTouch. Great! Nonetheless even for contrarians like me, it would be ridiculous to discount the importance of this introduction, for three reasons:

History does tend to repeat itself when the same team plays again: The iPod was introduced in 2001 amid great skepticism about the business model. Yet in FY2009 the iPod line and Music sales drove $12 B of Apple's revenue. By comparison on its 8th anniversary Google revenues reached only $10.6B. Beyond its own commercial success, Apple changed the way music is bought and sold as demonstrated by the disappearance of Tower Records in the U.S., and the tug of war between Hollywood studios and Apple. Likewise the introduction of the iPhone sparked an entire new segment of phones with touch screen devices, and brought down the mobile walled gardens. It stands to reason that Mr. Job's team will perform with the same flair and develop a new category of devices and uses that not so long ago were considered the realm of science fiction (like the Star Trek PADD).
Size does matter when it comes to consumer experience: At the 2006 3GMS conference, TV on the mobile was all the rage. Yet the use case flopped with consumers, in my opinion simply because watching your favorite show on a two-inch screen is paramount to torture. By comparison internet video traffic in 2008 (largely seen on PC and TV with Xboxes) equaled that of the entire U.S. Internet backbone in 2000 (Cisco) demonstrating the consumers' thirst for on-demand video with the right experience. So while I wouldn't expect from Steve Jobs anything less than hyperbole for the iPad, Internet traffic analysis does support his thesis that the time is right for a device that will allow one to browse a page at scale! What most caught my attention in today's announcement was less the immediate business opportunity of the iBook store than the possibilities offered by the ePub format, the standard for embedding multi-media content in publications. As proven by Avatar, experience is paramount to success with media and the type of mash-ups afforded by the iPad will enable new genres. Imagine what Lewis Carol would do with that!
Like the iPod, the iPad will morph: From a music device to a data terminal, the iPod went through a number of iterations. It is doubtful that anyone anticipated such app as the "cyber beer", or the always on pc terminal, or "Bump". Personally two years ago my iPod Touch was a great MP3 player with a fantastic way to browse music. Today I use it also as a portable radio (Pandora), a gaming device (The Quest), a movie database (Showtime), a tool (Level Tool) and my morning paper (CNN Money). So while many will lament the lack of an SD slot (largely driven by Apple's pricing strategy), it is safe to expect a flurry of radical apps, a camera (as with the latest iPod nano), OLED screens and other enhancements, in addition to accessories produced by third parties. For all we know a year from now Square will introduce an enhanced version of its service and card reader for the iPad (let's call it "Cube") to provide low end merchants with POS functionality up to now reserved for systems integrated with a cash register.

So, why am talking about new commerce category? Because the user experience and ecosystem that the iPad will enable will create very novel opportunities for commerce and transactions. Imagine for a moment:

An unbridled Facebook (not the mobile version) augmented with social commerce (thanks to PayPal X) anywhere, any time
Shopping at an appliance store with an interactive OEM agent to assist you
Digitally signing a commercial contract directly on the screen and triggering in real time the product delivery
Negotiating with a foreign client, assisted with real time audio translation

So to the risk of losing face I will therefore make the following predictions

Amazon will be selling the iPad before Christmas regardless of the future of the Kindle.
Google Wave will find its real footing not on Nexus One but on the iPad
Independent multi-media producers will distribute their content outside of studio control, directly on a "iMarketplace" within three years
Netbooks will disappear from the retail shelves by 2011 and be replaced by a variety of slate devices running Windows 7.
The iPad will become a video calling mobile device by the time 4G networks are reliably deployed
The next iteration of the AppleTV (let's call it iTV), rumored for 2011, will interact with the iPads, iPods and iPhones to extend the viewer's experience across multiple screens simultaneously.

My only wish and recommendation would be to see Near Field Communication integrated in the next generation of iPads, not for the purpose of taking contactless payment but to allow a simple intuitive interaction between my various Apple products. Synchronizing information with the tap of two devices, without configuration steps or network latency, would be as transformational to me as the use of touch screen was to zoom and pan across an image. More importantly for Apple, it would give me one more reason to trade-in an older iPod/iTouch/iMac or Wintel machine and to advocate with my friends that they should own one as well.

Agree / Disagree ? Contact me at patrick.gauthier@faultlinecommerce.com or twitter/PRGauthier

Follow Patrick Gauthier's blog, The Commerce Fault Line

Why Paypal May Do to Payments What Apple Did to the Mobile Ecosystem

Thu, 07 Jan 2010 09:00:00 -0500

PayPal Will Open Up the Walled Garden of Payments

The 4th quarter of 2009 is definitely starting to feel like the dawn of a new age for e-commerce, with many attempts to integrate commerce with social computing and mobile use cases. Many companies are vying for a spot as the primary gateway to payments, thus fueling a new round of innovation.

While I have been following with interest the likes of Boku, Zong and mPayy, the game changing announcement in my opinion came from PayPal, the "grand-daddy" of alternative payment platforms, as it was celebrating its 10th anniversary. Every payment related startup that I have been involved with has struggled with the capital intensity of building the right back-office functions, and the challenges of creating a critical mass of users and acceptance case. It is not only expensive, but fundamentally often involves reinventing the same wheel over and over again. Just consider the challenges, time and moneys associated with securing money transmitting licenses for instance.

One of the fundamental reasons for these challenges is that payments are one of the last remaining walled gardens in the modern economy. Notwithstanding the tremendous benefits brought by the likes of Visa and MasterCard, traditional card payments have proven difficult to secure, expensive for merchants and slow to adapt to emerging use cases because of the constraints of servicing the huge face to face volumes. Furthermore payment networks have protected their considerable market power by bundling their underlying services (authentication, authorization and settlement) making it particularly difficult for new entrants to offer alternatives PayPalX, changes these constraints in a fundamental way by giving to third parties means interface with account management and transaction processing flows. Suddenly commerce and payment innovators can build new offering without having to wade into "heavy plumbing".

To understand the far reaching nature of PayPal's new offering let's consider a few examples:

Redemption of points at POS: with loyalty cards in every wallets often going unnoticed by consumers, redemption of points of the point of sale has been the Holy Grail of loyalty managers for a quite some time. American Express was among the first to recognize it with its options to redeem points online for partners products. Yet the redemption of points directly at the merchant checkout while theoretically possible on traditional payment networks have proven difficult to integrate with existing payment processing infrastructure. PayPal's Adaptive Payments breaks down these barriers by enabling parallel and chained transactions.
B2B payments: ever since the advent of Purchasing Cards, attempts have been made to build commerce platforms that would allow further penetration of commercial payments. Yet supporting such common terms as "Net 30/5%-10" require complicated systems and transaction flows. By enabling third party applications to call payment transactions, without the intervention of the payer or payee, PayPal overcomes elegantly this challenge, which could propel business market places (such as www.alibaba.com) to new heights.
Payments in social networks: Traditional payment platforms are built on set roles (account holders/issuers/acquirers/merchants/acceptors). These are difficult to adapt in fluid groups of peers such as those founds in Social Networks, where everyone can be a sender or receiver of moneys and where the usual cycles required to open payment accounts are too long and complex. With Adaptive Accounts allowing a third party to create and manage accounts, conducting commerce in the midst of a social network becomes a reality, as demonstrated by Fundrazr.

Beyond opening up the payments' ecology to new participants, PayPal has also repositioned itself again as a strategic partner of the traditional payments players. Almost a decade ago when PayPal enabled acceptance at micro-merchants, it was welcomed by the payment industry for fueling transactions that would never have occurred otherwise. New volume is always welcomed. But as it became accepted at more traditional merchants, PayPal made more than one banking executive concerned about cannibalization. With PayPal X the old symbiotic relationship is back, as it enables new classes of transactions. I have a feeling I will be writing quite a bit more about it.

Agree / Disagree : Contact me at patrick.r.gauthier@sbcglobal.net or twitter: prgauthier.

Mobilizing Citibank: A Tale of Trials and Tribulations

Mon, 14 Dec 2009 12:57:00 -0500

Earlier this week, Citibank provided some perspective on their mobile strategy and their renewed focus on a better delivery of "traditional" customer service.

In the ever evolving landscape of mobile technology providers, Saucalito, CA based mFoundry received a vote of confidence for its ability to develop mobile client applications. One might think Firethorn and Obopay were not so lucky and jump wrongly to conclusions (especially when considering the recognition of Obopay by the World Economic Forum). Yet, this week was really not so different for many others in the land of the startup with its ups and downs.

So, why should we take notice? Because, in spite of its recent woes, Citibank kept alive a program of investments in innovation initiatives, at a time when most of their competitors seems to forget the very notion. The changes at Citibank highlight the struggles of building "mobile money." There are several lessons to draw from Citibank's announcements.

First, just as with web-banking a decade ago, integrating mobile into a bank channel strategy is a tale of trials and tribulations. As MaryLou Dowd pointed out in her interview with the American Banker, "Mobile banking is not a direct duplicate of online banking. A customer on the go has different needs than a customer sitting in front of the browser." Any Silicon Valley venture capitalist would have been happy to share this insight several years ago, since it fueled countless investments in local companies. Little though would it have mattered, as it takes experiencing the difference in order to appreciate it. Hence the importance of trying and investing in various options as Citibank did and too few financial institutions seem to understand.

Second, it is hard to remain committed to innovation when your core business is under deep restructuring. In the recent months Citi is reported to have focused on consolidation, including merging its internet and mobile groups. In parallel, Steve Kietz, the Citi representative at the helm of Mobile Money Ventures, has left the company. It doesn't require a lot of imagination to picture the turf battles and internal fights that occurred in the process, all of which are text book ways to undermine innovation. Let's hope that Citibank, the giant too big to fail, is not joining the masses of companies too big to innovate.

Third, Citibank's decision does underline a trend I have observed in mobile financial applications: unlike what was thought when Firethorn offered its Telco centric wallet, mobile money will not emerge on its own, but will be part of re-engineering commerce and banking. Mobile money is not about a new form of "old vs. new economy," but the expression of a channel to acquire, service and retain clients in existing markets with existing back-office functions in new ways. The case of USAA taking check deposits directly at the iPhone thanks to check imaging is exemplary in that regards. I am expecting in the coming months announcements from similarly forward thinking merchants.

This brings us back to Citibank and its goal of servicing better its clients. The real test of their strategy will lie with their ability to aggregate the multiple aisles of the "financial supermarket" into store fronts that matters to their target clients. We are barely in the first inning of the mobile money game. Let's hope that beyond alerts and mini-statements, Citi will continue to recognize the importance of experimenting to build a mobile experience relevant to the mobile generation; unless of course it aspires to be the bank of the Sandy Weil generation.

Square Aims at Mobilizing Payments

Thu, 03 Dec 2009 17:47:00 -0500

Once again the silicon valley is abuzz with talk about the new project from one of its heroes, but will Square, meet expectations?

A decade ago with the advent of e-commerce a wave of companies promised to radically transform the way payments were accepted, from wallets to micro-payments. This year, year 0 in the new calendar of m-commerce- has seen a number of promising announcements in mobile payment from the likes of Obopay, Boku or BlingNation. This week Square joined the fray and showed to the world what had been whispered in the Silicon Valley circles throughout the fall.

It is politically correct to praise the new venture of a Web 2.0 innovator, especially one with backers such as Khosla Ventures. Yet I have seen many highly anticipated payments products fail to achieve their promise. So what will if be with Square?

First the positives:

Top of all, Square does something that has proven elusive so far: make payments mobile friendly. One has to acknowledge the simplicity of the user experience and the uber-portability of the solution. If Square, ridding the iPhone waves enables acceptance of payment cards with micro-merchants, it will be a huge win.
Second, Square is keeping the barriers to entry very low: giving away the device (with a whisper cost of under $1), making the sign-on simple, requiring virtually no set up… all are positive changes for an industry which can take days or weeks and hundreds of dollars to enable a new payment acceptor.
Third, given the DNA of the founders, we should expect "squared" commerce applications emerging in the coming months. After all the company is showing the way with virtual loyalty cards and simple charity giving. Given the vibrancy of the iPhone environment someone will be able and eager to develop this around Square.

Without a doubt Square is therefore well positioned to challenge the providers of mobile terminals and gateway services. The Verifones of the world or startups such as Way Systems have offered solution still too expensive and inflexible for your proto-typical mobile merchant (for instance the Mary Kay reseller who wants to take payments, get it reported to her accounting software, have the order processed with the head office, get a receipt for the client, track the order later on...).

However Square also has some real challenges still ahead:

The deployment of new payment technology is always a challenge: Take the example of IP Commerce, a Denver startup which is very smartly applying a SaaS model to manage smaller merchant acceptance and has the backing of both Microsoft and Paymentech. While it is gaining market traction, it has not developed at the speed of many other cloud based solution. I expect the same reality challenges for Square, when it starts to manage hardware, register acceptors, perform risk management, comply with a sea of regulation, things Twitter didn't have to endure.
The target users and associated value proposition is still unclear: The YouTube demonstration at a coffee shop makes it clear that this is not a solution for the traditional checkout: the back and forth with the iPhone over a counter is slower than cash to say the least. But this implementation can no doubt be used by my plumber, my waiter…. However a simple device that plugs into the audio jack and is cheap enough to give away, will most likely have a short life either because it will get lost easily or suffer very rapidly from mechanical wear and tear real issues in any frequent usage situation. It wouldn't be the case for the truly occasional acceptor, but then why bother with "loyalty programs"? In all cases Square will have to contend with solutions such as that of Intuit that also offer practical card acceptance solutions.
Finally while the payment networks may have given a nod, it is not clear under what payment service rules (card present or not) and what are terms for the assumption of merchant risk. The Mobile phones are not known for their platform security, a dissonance with the direction of the payment industry as it rushes to point to point encryption and tokenization. Meeting the security assurance imperatives of the payment brands, while maintaining a business model with very low entry barriers for the users will be an interesting challenge.

In the end though the true uniqueness of Square may have less to do with a clever way of executing mobile payments, and more with the data hoard they could accumulate: a person's name, email address payment account, picture, possibly phone number, all validated by a payment transaction is a very valuable asset regardless of whether you are in the payments gateway business or not.

This valley falls easily to the power of hype, and its history is littered with examples of formidable innovators who could do no harm… and yet eventually proved to be mere mortals. Without prejudice for a team that delivered in record time two very interesting inventions (the card reading device and the iPhone experience), I think the jury is still out.

Agree / disagree: Tweet me at PRGauthier

Patrick Gauthier can be contacted at patrick.r.gauthier@sbcglobal.net or twitter: prgauthier.

blog

The Security Conundrum – Part 1: The Puzzle

The "New and Improved" PayPal

Recent announcements show how PayPal is taking on the mantle of Innovation Leader in the payment industry

Related Content

Is Visa Becoming Serious about Mobile?

Visa's appointment of industry veteran Bill Gajda is an important signal, but structural challenges to innovation will have to be addressed.

Related Content

NFC: Past, Present and Future

The announcement by the GSMA and its partners of another NFC demonstration pilot highlights how Near Field Communication is caught in the "trough of disillusionment." Commerce innovators shouldn't despair, the future is bright.

Related Content

Apple and the Dawn of i-Commerce

It will take a couple of iterations, but the iPad will open new frontiers for "e-transactions"

Related Content

Barbarians at the Gate: The Coming Disruption of Retail Banking

How Prepaid Cards Enhanced with Mobile Delivery Create a New Competitive Paradigm

Related Content

Why Paypal May Do to Payments What Apple Did to the Mobile Ecosystem

PayPal Will Open Up the Walled Garden of Payments

Related Content

Mobilizing Citibank: A Tale of Trials and Tribulations

Related Content

Square Aims at Mobilizing Payments