Please enable JavaScript to view the comments powered by Disqus.

We use cookies on our website to give you the best online experience. Please know that if you continue to browse on our site, you agree to this use. You can always block or disable cookies using your browser settings. To find out more, please review our privacy policy.

About


Take On Payments, a blog sponsored by the Retail Payments Risk Forum of the Federal Reserve Bank of Atlanta, is intended to foster dialogue on emerging risks in retail payment systems and enhance collaborative efforts to improve risk detection and mitigation. We encourage your active participation in Take on Payments and look forward to collaborating with you.

Comment Standards:
Comments are moderated and will not appear until the moderator has approved them.

Please submit appropriate comments. Inappropriate comments include content that is abusive, harassing, or threatening; obscene, vulgar, or profane; an attack of a personal nature; or overtly political.

In addition, no off-topic remarks or spam is permitted.

February 28, 2022

5G and 3DS: A Perfect Pair?

Not that long ago, when you heard the term "5G," you would probably mentally translate it to "five grand" or "five thousand dollars." Today, 5G refers to the fifth generation of mobile network wireless communications technology. Network operators promise that 5G technology will deliver much faster data transmission speeds, lower latency, and greater signal reliability, which consumers may not truly realize on the mobile front for several years as operators upgrade their cell tower networks. But are there benefits on the payments side we're likely to see?

My colleague Doug King first raised this question in a Take On Payments post in September 2018, when the industry thought 5G was on the cusp of becoming a reality. While the pandemic and regulatory concerns about security and safety have slowed implementation, it is now underway.

We have also previously written about the evolution of 3DS (short for "three-domain secure"), which was developed in 2000 to improve the authentication of a legitimate consumer's payment transaction with a merchant. The first version of 3DS was unsuccessful in the United States for a variety of reasons centered on poor consumer experiences that resulted in high shopping cart abandonment rates. However, as the share of digital transactions of overall retail sales continued to grow, the payments industry knew that new tools were needed to combat increasing fraud.

Recognizing that the 3DS process needed an overhaul to meet consumer, issuer, and merchant requirements, EMVCo released EMV 3DS 2.0 specifications video fileOff-site link in 2016. While this version results in a more complex transaction and was slow to gain traction in the marketplace until recently, its strength relies on the merchant's ability to send additional data to the payment card issuer. This additional information includes transaction, method of payment, and payment device information and is intended to help the issuer to run fraud mitigation tools more effectively, better detecting the fraudulent transactions and not denying the legitimate ones. The issuer, if still concerned about a transaction's legitimacy, can perform stepped-up authorization with the customer, including out-of-band confirmations. An out-of-band confirmation is authentication occurring on a different channel than the one initiating the transaction, such as when a banking app sends an email or text with a password the customer must enter in the app to carry out the transaction. A recent reportOff-site link indicates that 10 percent or less of transactions require this stepped-up authorization, and merchant adoption increased 50 percent during Q4 2021 compared to Q4 2020.

So how will 5G and 3DS work together? Transmitting and handling payment authorization messages with the additional data the EMV 3DS 2.0 specifications require can increase transaction time. Slow response time (latency) is a major factor in a consumer abandoning a shopping cart and the merchant losing a sale. The mobile network benefits of 5G will be realized over time, but many operators have already begun to support local 5G networks for small to mid-sized businesses requiring fast data speeds.

Such networks will allow these businesses to handle the additional message data, as well as additional payment devices, while providing better service levels. While the GSMAOff-site link (Global Systems for Mobile Communications Association) estimates it will take until 2025 before half of the mobile communications in North America will be on a 5G network, the uptake in the United States is expected to be faster.

I believe that the further adoption of EMV 3DS will be enhanced with the continued implementation of 5G technology in the United States. We will continue to monitor both technologies as well as when their expected benefits start to come about.

February 14, 2022

Contactless Card Pay More Than Doubled in 2020, but from Small Base

Readers of this blog know that we at the Retail Payments Risk Forum have for years scratched our heads at the tepid growth of contactless card payments:

  • Doug King in 2017: Wouldn't it be nice to tap and pay?
  • Dave Lott in 2019: Contactless cards: the future king of payments?
  • Me in 2020: Are contactless cards having their moment?

Now, data released in December by the Federal Reserve Payments StudyOff-site link find that amid the decline in the number and value of in-person card payments from 2019 to 2020, in-person contactless card pay increased both by number and value. You can see the appeal of contactless card pay in the COVID-19 pandemic: The ability to tap or wave a card or mobile device at the in-person point of sale could be perceived to reduce the risk of contagion.

From 2019 to 2020:

  • The number of contactless card payments more than doubled (up 140 percent from 1.6 billion payments to 3.7 billion)
  • The total value of contactless card payments also more than doubled (up 120 percent from $50 billion to $110 billion)

The number and value of contactless card payments also doubled from 2018 to 2019, although on a smaller base. The 2020 growth is especially impressive in the context of the overall decline in the number and value of in-person card payments that year. But am I convinced that contactless pay is having its moment? Well, no. That’s because looking at percentage increases can be misleading when the base is so small.

With their 2020 growth, contactless card payments remain less than 5 percent of in-person card payments by number (figure) and 3.5 percent of in-person card payments by value. Maybe not the "king of payments" quite yet.

chart 01 of 01: Contactless Card Payments

I am willing to believe, however, that throughout 2020 and 2021 merchants ramped up their ability to accept contactless cards for in-person payments (along with screens and procedures to separate employees and customers)—even as they pushed customers toward delivery and curbside pick-up. With acceptance more widespread, consumers should be less likely in 2022 to run into the sort of difficulties my friend encountered in August 2020, when she tried to find a merchant that could successfully accept a completely contactless payment.

For more on newer and emerging payment methods, see the most recent report of the Federal Reserve Payments StudyOff-site link.

February 3, 2020

Fuel Pump EMV Chip Liability Shift Looms Large

It has been quite some time since the Retail Payments Risk Forum has blogged about the state of the EMV chip in the United States. Perhaps the lack of coverage is a nod to the success and growth of EMV chip issuance and acceptance since the point-of-sale (POS) and ATM liability shifts that began in 2015 and 2016, respectively. The Federal Reserve's newly released payments studyOff-site link found that 57 percent of in-person card payments in 2018 used chip authentication compared to 2 percent in 2015. Talk about phenomenal progress over a three-year period! Yet there is more to do, and 2020 will be a big year for closing a big gap—EMV chip acceptance at the fuel pump, or what the industry generally calls automated fuel dispensers (AFDs).

In October, all of the global card networks' liability shifts will be implemented for AFDs. As a brief reminder, this liability shift means that petrol retailers will now be responsible for incurring the fraud losses on all non-EMV-chip-authenticated transactions initiated by EMV cards at their pumps. According to several industry associations that represent the convenience and petroleum store industry, this liability shift date will be a challenge for many station operators to meet given a limited availability of EMV-compatible AFDs as well as the technicians to install and certify the machines as EMV ready.

Through the years, the Risk Forum has stressed that criminals tend to gravitate to the easy targets when it comes to committing card fraud, or really any fraud in general. Card skimmers at AFDs pulling data off a card's magnetic stripe have been a major problem for decades. I have no doubt that the fraudsters are fully aware of the impending liability shift and will be stepping up their AFDs attacks in 2020 before the window of counterfeit card opportunity closes. Those retailers who are delaying their EMV migration or are unable to migrate by the liability shift date will become giant bulls' eyes. Expected card fraud losses in 2020 for the industry are not inconsequential—one industry association has estimated losses of $451 millionOff-site link. I should also note that the costs faced by the industry to migrate to EMV are also significant, at an estimated $3.9 billion.

After witnessing the successful rush by the industry to implement EMV chip at the POS and ATM, I am confident that the AFD EMV chip implementation ahead of the October liability shift will be a success, but all involved will definitely experience challenges. My confidence stems from the positive momentum I have seen from everyone involved in the payments industry working together for the common good to mitigate card fraud. With counterfeit card fraud losses through June 2019 down by over 60 percentOff-site link since September 2015, I look forward to seeing even more decreases in counterfeit card fraud following this year's AFD liability shift.

January 20, 2020

We're Number 1! But Why?

A new paper Adobe PDF file formatOff-site link from the Kansas City Fed asks the question, why are U.S. card fraud rates higher than those of other developed countries? Economist Fumiko Hayashi found that even after EMV migration in 2015, the U.S. had a significantly higher in-person card fraud rate than did Australia, France, and the United Kingdom. In all three years studied—2012, 2015, and 2016—the U.S. in-person fraud rate was more than three times higher than that of the other countries (see the chart).

chart 01 of 01: In-Person Fraud Rates

She attributes these differences to three factors:

  • The United States had a smaller share of chip transactions. EMV migration in the United States didn't really begin until 2015, compared to years (even decades) earlier for the other countries. According to the Federal Reserve Payments Study, 2 percent of in-person general-purpose card payments used chip authentication in 2015; that share increased to 57 percent in 2018.
  • The other three countries use the multi-factor chip-and-PIN verification, which is a stronger method than what U.S. networks use: most chip transactions are chip only. For in-person general-purpose card payments in the United States in 2018, the Federal Reserve Payments Study found that 21 percent (17.8 billion payments) used chip-and-PIN.
  • U.S. cardholders are more likely to use credit cards, which typically have higher fraud rates than debit cards.

Hayashi's paper gives a snapshot of the four countries at three points in time. Another approach to doing a country-to-country comparison would be to make a moving picture depicting the aftermath of the adoption of EMV chips for in-person payments. My Retail Payments Risk Forum colleague Doug King, in a paper published Adobe PDF file format in June 2019, looked at the change in in-person fraud for Australia, France, and the United Kingdom and found that fraud rates for in-person transactions dropped after chip-and-PIN implementation. You can see in the figure above that U.S. in-person card fraud rates declined from 2015 to 2016, over the time of EMV implementation here.

Keep in mind that this post is a simplification of two complex papers. For example, Hayashi also analyzed remote card fraud rates. And Doug included some data from other nations. If you want more information, the Federal Reserve Payments Study has reported details on fraud for noncash payments Adobe PDF file formatOff-site link in the United States, cards included, and also authorization methods for in-person general-purpose card payments (see figure 6 in the 2019 Federal Reserve Payments StudyOff-site link). I invite you to read these reports.