Blog article
See all stories ยป

Eliminating CNP from eCommerce

In the last couple of years I have heard arguments against EMV rollout along the lines that it is good for the physical POS but not for the eComm, and that the intoducing EMV at physical POS would only shift fraud threats toward CNP transactions mainly predominant in eComm. That may be true if one only considers using plastic smart cards. But by looking at the big picture it is clearly possible to utilize the mobile phone as the payment device @ POS (regular NFC in card emulation mode) but also for fully EMV compliant card present eCommerce payments over the air.

4800

Comments: (7)

A Finextra member
A Finextra member 06 October, 2013, 21:56Be the first to give this comment the thumbs up 0 likes You don't need to do it via EMV as the card networks will still treat such transactions as CNP (until they warm up to non-standard variations). As fraud reduction exercise, any out-of-bound 2FA is better than nothing, but the question is - what % of your target audience can support that. Most importantly, why would consumers bother - currently, CNP is not their problem...
A Finextra member
A Finextra member 06 October, 2013, 22:18Be the first to give this comment the thumbs up 0 likes My intention wasn't to debate political environment and obstacles within payment industry. However I believe that in this case payment schemes theoretically would not be seeing any difference between this transaction and online transaction coming from the POS ... so no changes would be required in any of the existing payment industry players ... Acquirers, Schemes and Issuers Ideally the Payment Schemes should see this option as a chance / opportunity to shut down EMV sceptics and have a case for using EMV in very similar fashion in physical POS payments and online EComm payments. Users could be liable for online payments unless they use this option - Payment Schemes could enforce that. Also if merchants get favourable CP txn fees from schemes and issuers if they steer users toward this way of paying as opposed to the CNP fees they could potentially steer the users
A Finextra member
A Finextra member 06 October, 2013, 22:32Be the first to give this comment the thumbs up 0 likes Look up rate difference between CP and *recurring* CNP. Add e-comm margins to the equation, and the fact that A rules the e-comm world. Sprinkle with card networks' inertia and snail pace. There were tons of GREAT alternatives to 3D Secure, yet...
A Finextra member
A Finextra member 06 October, 2013, 23:57Be the first to give this comment the thumbs up 0 likes

Yes unfortunatelly I have to agree with you ;-) As a technical guy I just wanted to help the industry hav at least one elegant option on the table and potentially be able to make the better EMV case. As they say "if there is a wil ...".  

A Finextra member
A Finextra member 07 October, 2013, 11:14Be the first to give this comment the thumbs up 0 likes

Isn't this pretty much the model MasterCard are trialling with ING in the Netherlands? EMV for Ecommerce using a mobile enabled transaction via QR Code. I imagine this is high on their road map for MasterPass to give real reason for Merchants to want to integrate it in their online flows - particularly if they introduce EMV-equivalent PIN secured interchange.

A Finextra member
A Finextra member 07 October, 2013, 12:16Be the first to give this comment the thumbs up 0 likes

I do not honestly know details of the MasterCard MasterPass implementation, but if they are trying to do something similar to this that would be a good for the industry. I believe that original EMV security (especially with the introduction of its derivatives, like the PayPass / payWave contactless technologies) is applicable as-is to many payment channels not just physical POS and plastic card form factor. Instead of introducing another 2 factor authentication technique just for the eCommerce why not use the same model?

 

A Finextra member
A Finextra member 07 October, 2013, 13:47Be the first to give this comment the thumbs up 0 likes

Off course this whole model can be used at physical POS, which is not contactless enabled, but which can generate and display proper QR code