payments - Retail Systems

“A more convenient token based on a mobile phone is how
the market is likely to evolve which will at least start addressing
the customer inconvenience problem. Let’s face it, the average
person these days doesn’t leave the house without their chosen
mobile device, and therefore will always have one available to
provide authentication.”
This mix of security and convenience is vital to keeping your
customers both happy and protected, adds Sascha Breite,
managing director of SIX Payment Services. “It is very important
to show customers that you have a secure website – showing
that you have authentication and also a security certificate.
These things are easy to achieve but must be done.
“The more convenient your system is, the better – and that
is why mobile devices will be so important. In Germany for
example, 80 per cent of the market is using smartphones so
your applications should be shaped to separate devices.
“Offering one-click payment like Amazon is important too.
Merchants can store customer details to save them entering
them again and again. But for that the customer must trust the
merchant.”
However, risks go far beyond internet payments, and one
of the main areas targeted by the fraudsters is call centres,
according to Graham Thompson, sales and marketing director
for Semafone.
Fraudster targets
“Because chip and PIN has eliminated a lot of fraud in shops, and
3D Secure has done the same in e-commerce, there is increased
fraud in the mail order telephone industry, where people
contact call centres to make fraudulent purchases.
“You also have criminal gangs infiltrating centres, working
hard to build up to management and then hiring other
members, or gangs leaning on call centre workers to get them
to pass on details.
“There is no authentication process for the cardholder to
identify themselves, but we are looking at ways to change
that. We want to utilise mobile phones but the challenge is that
phones are not yet seen as secure devices themselves, but I’m
sure that will come within the next few years.”
Investment in new systems and new technology has played
an important role towards the reduction of CNP fraud in recent
years, but how vital is it to continue that investment in the
future?
Neira Jones, head of payment security for Barclaycard,
believes sophisticated screening tools introduced in recent years
have been instrumental.
“New technologies, such as those using behavioural real-time
session analysis as opposed to traditional transaction analysis,
are making great strides to combat CNP fraud. The growth of
MasterCard Secure and Verified by Visa has definitely played a
major role,” she said.
However, she is reluctant to say investment in new technology
is needed right now, believing that openness can be every bit
as important.
CNP fraud supplement
“Solving the problem of fraud doesn’t necessarily mean
investment in new technology. There is a perception that
security is always a technology issue, but I disagree. I have
often heard problems with security being tarnished as too
expensive, complicated, hindering innovation and something
for the ‘techies’ to deal with. Most worryingly, opinions
that data breaches ‘won’t happen to me’. It’s only when
experiencing a crisis that everyone pays attention and starts
pointing the finger.
“Conversely, the information security community has also
been, in the main, guilty of perpetrating a certain mystique by
relishing in the kind of techno-speak business colleagues will
never be interested in.
Dispelling myths
“Therefore it’s vital for everyone within the industry to start
talking about security in plain English, to dispel these myths.
Security should be an inherent and recognised part of any
business at all levels. At the risk of being trite, it’s about people,
processes and technology, and sometimes just changing a
process can make you more secure.”
So while things are improving, the fraudsters are always
looking for new methods of infiltrating security – so what about
the future.
SIX Payment Service’s Briete adds: “Online merchants will have
their security in place by now, but what will be important is to
get the trust of cardholders and bring the use of mobile phones
together. We will have contactless cards until we get contactless
phones.
“But we have to be open and make some hard decisions about
what technology comes through. It’s 10 years since the start of
contactless technology and I now feel something is changing in
the market, but that will take another five years.”
But with the general view seeming to be that the next huge
change will be mobile phone authentication and contactless
devices – still a few years away – what methods of payment
security are going to bridge that gap to protect customers and
take on the criminals?
Maria Jose Goncalves, director of the retail market for WeDo
Technologies, believes there are already systems in place to help.
“Studies have shown that people are using PayPal much more
now and new options of payments like mobile phones have to
be looked at. There have been so many stories of credit card
abuses that people are using other types of payment. Of course
there is always a risk, but they are much smaller when using a
service like PayPal, which is controlled and offers a different
type of validation.”
She adds that the PCI’s Security Standards Code will also have
an important job to do going forward.
“There needs to be support for the development of more
secure systems, and if we are going to start using mobile
phones for payments then all stakeholders will have to be
involved in that process. If you don’t know how things are
working and changing then you cannot control them.”
RS
June - July 2012 RS 27