Community

Biometric has seemed the way to go for over a decade. It almost became a reality in India recently: With the GoI’s Aadhaar biometric National ID program enrolling fingerprints of over 500M Indians, the government / RBI tried to push banks to enable POS and ATMs for biometric authentication. In addition to Chip, PIN and Signature, that is, thereby resonating with my earlier comment about India is a low hanging fruit for all kinds of security technololgies. Banks pushed back, citing the manifold increase in bandwidth and processing power required to handle fingerprints. That’s the last we heard of the plan. Alas, biometric will continue to be the way to go for another decade unless there's some new disruptive technology that solves the technical problems of rolling out biometric authentication at scale for a mission-critical use case.

I don't have any numbers but am willing to bet that a majority of American consumers don't even know what "payments processing infrastructure" entails, let alone lose confidence in it in the event of data breach / fraud. And, why should they bother? In USA, when I spot a fraudulent charge on my credit card statement - and there are apps for that - and report it to my bank, it gets reversed immediately, no questions asked. When I’ve tried doing the same in ROW, it’s a nightmare. That’s why US consumers are not - and don’t need to be - so obsessed about fraud containment as the ones in ROW.

From the merchant pov, fraud is bad but losing revenues when the PIN-introduced friction causes a transaction failure is many times worse.

@BillT:

1. It’s naïve to claim that somebody imposed something on someone but, playing along for the moment, the imposee must take responsibility for its decisions. For example, RBI, the Indian central bank cum banking regulator has gone on record saying, "security first, convenience next" when it comes to card transactions, so it's no surprise that India is a fertile market for all kinds of security measures including both Chip+PIN and Chip+Signature! From my personal experience in Europe, security overshadows convenience, so, again it's not surprising that it'll be a receptive market for security measures. Whereas, in the USA, convenience reigns over security, so it hasn’t implemented 2FA and other security measures implemented by the ROW several years ago and the sky hasn’t fallen as a result. “Different strokes for different folks” is how I see it. Much as I'd like to think that what's good for India is good for the world or dream that an European strategy is a global strategy, reality dictates otherwise. I’m no global strategist but, from personal experience, the more an ROW strategy is thrust on USA, the more USA will scuttle it.
2. This article, Stephanie Ericksen's statement and my comments - all pertain to USA only. Who's talking about the whole world?
3. The onus is on change advocates advocating a shift to Chip+PIN to produce the numbers, with the two key metrics being (A) Fraud loss as % of Sales (B) Revenue loss due to friction introduced by PIN. From personal experience and anecdotal evidence, PIN hasn’t reduced (A) whereas it has increased (B), so PIN is a bad idea. But I agree I must look at hard data. Since you claim that most people have the data, you should be able to provide it easily. For all the posturing about data, I couldn’t find any of it in this article or in the above comments and, for years, I’ve been soliciting for it right here on Finextra (in my blog posts or comments e.g. here, here) without receiving any concrete response. 

I'm neither an expert "available to help out with any implementation issues" nor could I care less which way USA went but, in the interest of restoring some balance: 

1. I see nothing wrong in Stephanie Ericksen's statement, "we can rely on online processing where transactions are transmitted in real-time to the issuer for approval. With that in place, there's no need for the offline authentication that was the genesis of chip-and-PIN."
2. ROW adopted 2FA for for sensitive NetBanking transactions and all online card transactions several years ago. USA still has not. However, I haven’t seen any clear evidence that fraud as a % of transaction value is any higher in USA than ROW.
3. Any discussion of reduced fraud as a result of implementing Chip + PIN has to be viewed against loss of sale - or shift to cash - driven by PIN, both in terms of UX friction and change in POS equipment. Many places where I used to pay by credit card earlier, I'm now forced to pay by cash because of PIN-related problems.
4. And it's not as though there's no card fraud in Chip + PIN regimes in ROW where a bulk of fraud has moved to online / CNP transactions where Chip + PIN doesn't help. 

One size doesn't fit all, especially when we're trying to force fit the ROW style to the country that invented the credit card and is home to the leading credit card networks in the world including Visa. I trust them to know and do what's best for their country, keeping in mind their local consumer behavior and business culture.

@AdityaG: Good question. I've a few likely answers: (1) I've used taxis in at least 10 countries. I haven't seen a single driver paying for fuel and other expenses by credit card (2) Even if they do, it's basic human nature to want to "eat your cake and have it too" (3) A cabbie once told me he broke off from Taxi Company X and Y because they delayed his payments well past their T+15 day commitment and signed up with Company C because this company was reputed to pay on its committed T+7th day (4) Problem with deferred payment is not technology or the deferred period per SLA. It's that the payee has already rendered a service and is helpless in front of the payer who suddenly achieves supreme power to keep delaying payments on a whim. Apparently, some payers even demand a bribe to release payments.

And the same customers who were hard up enough to accept a free mobile phone plus plan from their bank as a price for handing over their entire lives to their bank would then have enough money to buy whatever their banks offered them at the right place at the right time? Interesting idea.

Despite going online almost two decades ago, only a handful of retailers have managed to navigate past their internal silos and political dynamics to restructure their pay structures in such a way that their store staff get comped for online sales, that too only for store pickup orders. Wonder when this practice will take root in the banking industry where the silos are notorious for being very strong! 

Even if big banks don't want some customers, some customers want big banks. 

http://www.mainstreet.com/article/why-americans-are-going-back-to-the-mega-banks-that-burned-them

Kudos for a balanced post. 

"It is important to note that this 85% success rate ... an out-bound sales call." ---> Whenever I needed to open an account or remit some money or withdraw cash beyond ATM limits or whatever, I've just walked into a branch (assuming I would / could not carry out the said action via remote channels). Maybe it's only me but my branch visits were never driven by any outbound sales call by the bank. 

"The big issue with the digital account opening process ... constrained by legacy systems." ---> Banks in India have no legacy systems and yet insist on F2F before they can complete account opening. Regulation, not legacy, is the culprit.

"The question for banks ... streamlining the sales process both in branch and online rather than which to focus on the most." ---> Totally agree. After all, branches and digital channels are both owned by banks - it's not as though branches are outcasts! A couple of years ago, a midsized Indian bank carried out Conversion Rate Optimization to boost conversion on its online account opening portal and invested in training for sales staff to do the same at its branches. Thanks in part to these efforts and in part to the acquisition of another midsized bank, this bank has now become a Top 3 private sector bank in India!

Not sure whether FPS, TARGET2 and SEPA qualify as modern payment systems but, in my experience of running their implementations, business always asks why automated testing isn't being used and IT always pushes back saying modern payment systems are too complex, change too fast and are subject to too many adhoc moving parts driven by nebulous regulation for automated testing to work. If automated testing has now become flexible enough to handle these challenges, the industry should evangelize the market accordingly.

It's now over two years since I wrote this post, and, to quote from this article by Gareth Lodge of Celent, 

"cash is by far the most dominant, as at 50% share, it’s obviously the same size as all the other payment types …combined. So cash isn’t dead, and not even mildly under the weather!"

@AbhishekC: TY for your comment. You couldn't be more wrong about my personal preference: Like I pointed out in another blog post, Cash in Hand Is Worth More Than Card In Bush, "Ever since I got my first credit card in the mid 1980s, I've preferred cards over cash for several reasons (think rewards for one!)." However, you could be very right about the overall market: According to this latest Celent article, "cash is by far the most dominant, as at 50% share, it’s obviously the same size as all the other payment types …combined. So cash isn’t dead, and not even mildly under the weather!"