MCX confirms merchant exclusivity terms; reveals hack

MCX confirms merchant exclusivity terms; reveals hack

MCX, the mobile payments joint venture set up by a coalition of some of the largest retailers in the US, has confirmed that members using the system will be contractually obliged to exclude alternative platforms provided by the likes of Apple and the telco-backed Softcard consortium. Meanwhile, the group has confirmed that pilot participant email addresses have been stolen by hackers.

The issue of exclusivity has come to the fore following the decisions by MCX member firms CVS and Rite Aid to block Apple Pay transactions in their stores.

In a blog post explaining its position, MCX says: "MCX merchants make their own decisions about what solutions they want to bring to their customers; the choice is theirs. When merchants choose to work with MCX, they choose to do so exclusively and we’re proud of the long list of merchants who have partnered with us. Importantly, if a merchant decides to stop working with MCX, there are no fines."

During a hastily convened press call, MCX CEO Dekkers Davidson again claimed, contrary to a New York times report, that there are no fines for members using Apple Pay. Asked if retailers are able to leave at any time, he replied only that they are "free" to make the best decisions for their consumers.

In the future, he suggested that it is possible that merchants could accept both CurrentC and Apple Pay, conceding that it will likely require two or three successful players to reach the mobile payments tipping point, but, for now, it is one or the other.

Davidson also moved to downplay the importance of QR codes to CurrentC, insisting that the platform is technologically agnostic and that the group is already working on BLE options, with NFC a possibility in the future.

The group, which claims support from 50 merchants at 110,000 US high street storefronts, says its barcode scanning payments and loyalty system was conceived at a time when the market lacked a viable mobile wallet that would benefit both consumers and retailers.

"Today, we believe that need still exists, and our working group is getting ready to reveal a solution that is different from other mobile payment options in many important ways."

Whether the group will be allowed to enforce its terms of service is questionable. Earlier this week, the bank-backed trade association ETA branded the boycott of alternative mobile platforms as 'anti-competitive'.

"This decision has nothing to do with convenience, reliability, or security," stated the lobby group. "Because MCX says its retailers represent 1/5 of total US retail sales, this group boycott could negatively impact consumer choice in the mobile payments marketplace."

Worse still for the MCX retailers, the JV has confirmed that in the last 36 hours it has discovered that pilot participant email addresses have been taken following a data breach. The group says that no other information was taken and that the CurrentC app itself was not affected. Nevertheless, the news rather flies in the face of an MCX pledge that "consumers’ privacy and data security are our top priorities".

During today's press call, Davidson refused to name the third party vendor which was hacked and said that incident would not affect the timeline for the CurrentC public launch. He also refused to speculate on who could be behind the attack but did note that the JV was taking on an established industry and expected to faced resistance.

Comments: (9)

Brett King
Brett King - Moven - New York 29 October, 2014, 15:52Be the first to give this comment the thumbs up 0 likes

This is, frankly, ridiculous...

A Finextra member
A Finextra member 29 October, 2014, 16:44Be the first to give this comment the thumbs up 0 likes

While I can kind of see where they might be coming from, I suspect the eventual full release version of MCX and its app will have moved on a bit - or at least should do beyond QR/barcode scanning. Here's hoping...

Ketharaman Swaminathan
Ketharaman Swaminathan - GTM360 Marketing Solutions - Pune 30 October, 2014, 14:23Be the first to give this comment the thumbs up 0 likes

If they can't even protect a pilot from breach...

A Finextra member
A Finextra member 30 October, 2014, 17:26Be the first to give this comment the thumbs up 0 likes

As they say; fail early fail fast - better to learn now than later..!

A Finextra member
A Finextra member 31 October, 2014, 14:32Be the first to give this comment the thumbs up 0 likes

The CEO claims that their goal is to "create a fabulous consumer experience" but their strategy to ensure uptake is to limit choice?

I can't put it better than Brett did above.

Dean Wallace
Dean Wallace - ACI - Global 02 November, 2014, 08:48Be the first to give this comment the thumbs up 0 likes This is interesting. I'm looking forward to seeing what MCX unveils. To show such preventative / competitive matters before an actual launch / promo must mean they have something special, right? Hopefully something that covers the shopping experience, and simply a '1 click payment' step. Something that gives value to consumers, attracting them to shop with a CurrentC merchant. That would be a proper showcase for mobile payments. Re the email address, I'm not sure how people having these really plays into the hands if fraudsters. Perhaps someone can enlighten me with how "losing" something arguably already in the public domain can result in fraud losses that would be great.
Ketharaman Swaminathan
Ketharaman Swaminathan - GTM360 Marketing Solutions - Pune 02 November, 2014, 12:54Be the first to give this comment the thumbs up 0 likes

@DeanW:

While I agree that the breach of email addresses can't result in fraud:

  1. A breach is a breach is a breach. Just because breaches prior to the one I described in https://www.finextra.com/blogs/fullblog.aspx?blogid=7711 didn't result in financial losses doesn't lower the seriousness of the prior incidents
  2. It's not self-evident that people's email addresses are in the public domain
  3. "If my email gets breached today, who knows what else will get breached tomorrow" is probably what an average customer might take away from this incident.
Dean Wallace
Dean Wallace - ACI - Global 02 November, 2014, 16:56Be the first to give this comment the thumbs up 0 likes Hi Ketharman I take your points on email address and the link to bad perception / bad practice. Good job it's early days I gueas and as Marcus notes above, best to catch now and improve ethos. I'm still eager to see what they launch with. Should be good to see and I'm hoping for something NOT JUST about the end of the shopping process (ie the payment bit :-).
A Finextra member
A Finextra member 03 November, 2014, 11:55Be the first to give this comment the thumbs up 0 likes

As I've commented elsewhere, while I understand the desire and drive the banks/issuers/providers/processors etc have re developing and controling mobile payments, payment flow should not be at the end of, or a bolt on to the user experience of the app, but instead very much integral to it from the moment the app is launched. This is why I'm keen and encourage that retailers take up the mantle and not neccessariliy let the shopping/basket experience drop out to a banking/wallet app for a simple payment transaction. More collaboration is needed rather than land grabbing..

Trending