As I have found out, the definition of “mobile payment” is defined by to whom you are talking. For consumers, mobile payment means using their smartphone to pay for goods and services. For merchants it includes the consumer definition as well as using smartphones or similar mobile devices to process payments.
Last year I wrote a post regarding mobile payments and the use of smartphones, primarily the iPhone, for use as credit card terminals. When I wrote that first post, Apple was running an advertisement for the iPhone that showed it being used to process a credit card payment with the ubiquitous tag line, “There’s an app for that.” Shortly after that post, the advertisement dropped the iPhone as a credit card terminal. I am not aware that the PCI SSC or any of the card brands complained about that advertisement, but I found it interesting that those images of it processing a credit card were removed particularly given that a number of security and privacy issues that were and still are being discussed regarding the iPhone.
That is not to say that iPhone credit card adapters have not continued to be developed. It is just that they are nothing like the one shown in that original Apple advertisement. The first one that I came into contact with was Verifone’s PAYware Mobile solution and the fact that it is PA-DSS certified. Whoa! In my previous post I talked about all of the issues with the iPhone that make it almost impossible to be PCI certified. How did Verifone create a PA-DSS certified application on the iPhone? What Verifone did was to create a digital back to the iPhone. All of the operations that need to comply with the various PCI standards are done through the digital back, not the iPhone. The iPhone is just used as a display. In the event that a credit card will not swipe through the digital back, the customer must go to a standard register. I have also been privy to a number of similar iPhone applications. All of them avoid the iOS interfaces as iOS is the problem in achieving PCI compliance.
While iPhone is the “Big Kahuna” of smartphones, it does not mean that Android and Windows Phone devices are not also used for credit card payments. Unfortunately like the iPhone, Android and Windows Phone devices have similar issues that make them difficult, if not impossible; to have PA-DSS certified applications. So from a merchant perspective, iPhone, Android and Windows Phone all have to be treated very carefully when they are used to process credit card payments.
But security concerns have not stopped merchants from rolling out mobile payments. Starbucks recently introduced an iPhone and Android application that allows the customer to put their Starbucks cash card on their phone. The application creates a 2D bar code with the cash card’s number. The Starbucks POS system reads the bar code and automatically deducts the purchase from the account’s balance. Within a week of releasing the application, it was determined that if you take a picture of the screen containing the bar code, anyone with the bar code can use the account until it cannot pay for a purchase. So much for secure mobile payments.
If we expect to secure payments, the traditional credit card is just not going to get the job done. EMV, aka Chip and PIN, is a short term technological fix but also a back up payment method for where I think we are really headed. I truly believe that the future in payments is smartphones and other mobile devices with software that generate one-time transaction codes for paying for goods and services. Whether those codes are displayed as a 15/16-digit number or bar code on a screen or transmitted via Wi-Fi, Bluetooth or RFID, a consumer will not need a traditional credit card. A 15 or 16 digit number will be necessary to use so that POS systems do not have to be re-engineered to support the new payment method. Scanners are already capable of reading bar codes from smartphone screens, so that much of the solution is already in place. Wi-Fi, Bluetooth and RFID technology is coming as we speak so it is only a short matter of time before the infrastructure is in place to support such a solution. All that is needed is the software.
Such an approach not only will secure card present transactions, but would also tackle the security issues we face with card not present transactions. If done right, mobile payments can become the solution to our PCI compliance problem.
