Welcome to Mobey Forum’s Snapshot of Mobile Payments
Transcript of Welcome to Mobey Forum’s Snapshot of Mobile Payments
Welcome to Mobey Forum’s Snapshot of Mobile Payments
The Webinar Recording is available on the Members’ Area at http://www.mobeyforum.org/posts/announcements/for-members/?future=
Please share this information only within your organisation – not publically. 1
Presenters
Zaf Kazmi, Head of Mobile Payments & Commerce, CaixaBank.
Chair of Mobey Forum’s HCE workgroup
and
Kristian T. Sorensen, Senior Manager for Corporate Strategy, Nets.
Vice-Chair of Mobey Forum’s HCE workgroup
2
What’s going on?
The Google HCE dilemma
The current SOA of Mobile Payments
Latest explosion of different Mobile Payment solutions
A real headache for Financial Institution
One stop guide to assist FI’s?
This slide set includes some speculations and guesses – but highlights the core issues within any Financial Insititution in the jungle of payments
3
SIM-based solution
ApplePay(USA-only
for the moment)
SamsungPayin Europe (not launched yet)
SamsungPayin USA
Host Card Emulation
Google Wallet(USA-only
for the moment)
*Speculation only*
Type Physical SE: UICCPhysical SE: Embedded
Physical SE: Embedded
Magnetic Stripe transmitter
SoftwareEmbedded SE or
software
OwnershipMobile Network
Operator Apple Samsung Samsung Bank Google
Control MNO Schemes / Apple TSMs / Samsung LoopPay / Samsung
--Bank--Delegated control on solution provider
Google / Android
Multiple applets from multiple issuers on the same SE
Yes Yes:Visa, MC, Amex...
Yes:Visa, MC, Amex...
Yes, LoopPay wallet supports IDs, loyalty, and
membership cards.
N/A No
Tokenization Used
No YesMost likely-
encrypted full PAN sent to the eSE
In the future, yesmost likely
Optional --physical SE
--own solution--tokenization
Yes (wallet identifier).
Once again: Secure Element
© Mobey Forum
Is there a Third Party Role?SIM-based
solution
ApplePay(USA-only
for the moment)
SamsungPayin Europe
SamsungPayin USA
Host Card Emulation
Google Wallet(USA-only
for the moment)
*Speculation only*
Trusted Service ManagerTSM
MNO TSM / SP (Bank) TSM integration
needed
Apple and payment
schemes provide TSM provisioning
services and aggregation
Almost any TSM can join Samsung
Key Management
Service
Schemes provide services, in addition to
LoopPay
N/A
First Data *was* the TSM for
Softcard. This is likely to change
in the new power
equilibrium with Google taking
over.
Tokenization ProviderTSP
N/A Theoretically
possible to use tokenization
(storing purposes)
Payment Schemes provide
tokenization service between Apple SE and SP
Payment Schemes provide
tokenization services?
Payment Schemes
Anyone who provides TSP
services: Payment schemes,
processors. Banks can do also in-house.
Unknown
© Mobey Forum
Acceptance StatusSIM-based
solution
ApplePay(USA-only
for the moment)
SamsungPayin Europe
SamsungPayin USA
Host Card Emulation
Google Wallet(USA-only
for the moment)
*Speculation only*
How widely the solution is used at the moment
Each bank needs an agreement with
each MNO
Over 700 banks in the
US
No official date as yet
Announced at the MWC 2015
As soon as the bank can
implement the solution
Exact data unavailable
POS type requirement
On all activated contactless terminals
on all activated
contactless terminals
on all activated contactless terminals
on all non-EMV terminals (>90%
of all POS terminals in US)
on all activated contactless terminals
on all activated contactless terminals
© Mobey Forum
Devices SupportedSIM-based
solution
ApplePay(USA-only
for the moment)
SamsungPayin Europe
SamsungPayin USA
Host Card Emulation
Google Wallet(USA-only
for the moment)
*Speculation only*
* depends on MNOs offering
SIM based solution and
commercial & technical
implementation model
* customers with suitable devices
* customers need to change SIM
Customers with iPhone 6 & newer
Customers with Samsung Galaxy S6
& newerCustomers with
Samsung Galaxy S6 & newer
Customers using Android 4.4 or
newer orBlackberry 10 &
newer
Most Android devices running 2.3 or higher
© Mobey Forum 7
Analysing the Business ModelsSIM-based
solution
ApplePay(USA-only
for the moment)
SamsungPayin Europe
*Speculation only*
SamsungPayin USA
Host Card Emulation
Google Wallet(USA-only
for the moment)
Relationship to SE owner
MNOs issue new UICCs
Bank signs up for ApplePay
Banks Signs up for SamsungPay
N/A N/A None
Business model
Bank pays for TSM and MNO.
Negotiable. Depends on the
market.
Bank pays part of the interchange
and other fees to Apple.
Rates adjusted by Apple per market.
Bank pays for TSM. TSM pays for
Samsung.
Not known.
Expected to follow the
business model of ApplePay
Bank pays for solution provider. In in-house model only investment
costs.
No fees nor role for bank.
Data monetization based business model.
Transactions completed through a MasterCard /Discover Virtual Debit Credential provisioned for every active Google
Wallet. Customer is charged 2.9% to top it
up.
Customer experience
Dependent on MNO. If bank-
owned wallet, bank controls UI.
Bank has no control on UI.
Unknown Unknown
Bank controls customer
experience. There might be
some interaction/ collaboration
needed in case of several banks'
wallets in the same handset.
Bank has no control on UI.
© Mobey Forum
9
”MNO-Pay”
• UICC as SE
• NFC Payments
• MNO(s) as a trusted partner(s)
”OEM-Pay”
• ApplePay (Only in US) NFC
• SamsungPay with MST (Only in US)
• SamsungPay with SE’s (maybe coming to Europe in 2016??)
”Bank-Pay”
• On any chosen technologies, such as HCE
• Branded as Bank, designed by Bank
• Combined with mobile banking app / PFM / P2P...
3 Groups – Which horse to ride on?
© Mobey Forum
SOME KNOWN VULNERABILITIES...Fraud in ApplePay.....
10
“The criminals are trying new techniques to compromise the Apple security chain. While the Apple devices and software are relatively secure and difficult to compromise, the crooks are orienting their efforts to hit what is considered the weakest link in the security chain,
the humans.”
So the weak link is not
the ApplePay itself, but
the processes to activate it /
authorize the payment.
11
Revealed by Cherian Abraham...
Sources: http://securityaffairs.co/wordpress/34359/cyber-crime/apple-pay-fraud.htmlhttp://www.droplabs.co/?p=1231
Phase 1: Consumers can take an image of their card, allowing the app to scan their credentials. OR they can also manually enter the details = crucial for the implementation of the fraud scheme.
The information (such as iTunes account with device name, current location, transaction history) is sent to the bank service that can authorize the card for Apple Pay, or require additional information.
Phase 2: The cards could be automatically approved or declined, as per listed in the green or red path. Apple also introduced a third mandatory path, the yellow path, that is used to request further checks to banks and card issuers.
• The implementation of the yellow path depends on the specific card issuer, each of them can perform a different number of checks, including a direct contact with personnel of the call center. The use of call centers for additional verification is the elements exploited by criminals for their illegal activities.
• In the Apple Pay fraud schema, cyber criminals call the call center to convince the operators to add an Apple device to an account, and ask to activate the Apple Pay. In this way the crooks avoid the checks requested by Apple to the Bank by exploiting the human factor.
12
...continues
Source: http://securityaffairs.co/wordpress/34359/cyber-crime/apple-pay-fraud.html
30% of cross channel fraud are conducted through social engineering attacks against call center. (John Zurawski, VP at Authentify)
“The call center is typically there to resolve an issue – not do any banking. In the Apple Pay fraud discussed, the fraudsters must be calling the call center, convincing someone to add an Apple iPhone 6 or better to an account, and
asking to activate Apple Pay. The actual Apple Pay activation is initiated between Apple and the Bank. Apple passes to the Bank a person’s stolen credit
card info, including the details backing their iTunes account,” he said.
Source: http://www.csoonline.com/article/2891673/loss-prevention/crooks-targeting-call-centers-to-further-apple-pay-fraud.html#tk.rss_all
13
Human is the weakest link
Is NFC finally here – yes indeed
Wasted a lot of time, now finally we have options, BUT: none is a clear winner.
Banks need to enter the game. And compete for customer attention and loyalty.
From payment to commerce and further to value added services specific for financial instititutions.
No right or wrong solution for a bank.
Lessons learned from existing payment solutions.
14
Conclusions
© Mobey Forum
Special Thanks to
Neil Smith Proxama Bastien Latge InsideSecure
Ciara Myers Allied Irish Bank Douglas Kinloch InsideSecure
Ben Smith American Express Evgeny Bondarenko Intervale
Philippe Roy DanskeBank Yuri Grin Intervale
Michael Hoffman DanskeBank Bhaskar Chaudhary Mahindra Comviva
Bent Bentsen DNB Bank Rajasekaran Soruban Mahindra Comviva
Ville Sointu Ericsson Nitin Jain Mahindra Comviva
Henrik Karlsson Ericsson Sverker Akselsson Nordea
Thor Ragnar Klevstuen Evry Julien Traisnel Oberthur
Hans Ilstad Evry Andre Zoelch PostFinance
Jukka Yliuntinen Giesecke-Devrient Tom Pawelkiewicz Scotiabank
Tapio Vailahti Giesecke-Devrient Eduardo Galvao SIBS
Neal Michie Helixion Philippe Stahel UBS
15
© Mobey Forum
Please use the chat function to submit your questionOrRaise your hand, and we unmute you.
Any Questions?
16
THANK YOU FOR ATTENDING THE WEBINAR
For further information on Mobey Forum please visit us at www.mobeyforum.org
Please share this information only within your organisation – not publically.
17