The Bridge to Chip and PINFed Reserve Exec Sees Mobile Banking as a Payments Catalyst
Richard Oliver, an executive with the Federal Reserve Bank of Atlanta, says increasing incidents of payments card fraud in the United States will soon push the banking industry away from the mag stripe and toward the more secure chip and PIN standard, which is rapidly being adopted throughout the world.
In this second part of a two-part interview with Oliver, a 37-year Fed Reserve veteran, Oliver shares his views on globalization, on the unrealized costs of card fraud, and on the adverse impact U.S. mag-stripe cards are having on cardholders even in EMV-compliant countries. Building on the weaknesses of outdated payments technology discussed in part one, Oliver says there's little question the U.S. will make a move to chip & PIN. What remains unknown is how the U.S. financial industry will get there.
In this exclusive interview, Oliver, the first U.S. banking industry executive to publicly declare his support for a U.S. move to EMV, discusses:
- Why U.S. financial institutions are examining new payments technology;
- How many U.S. retailers have already silently made systems and device upgrades in preparation for chip & PIN payments; and
- The significant role the mobile channel will play in pushing the U.S. toward a more secure payments standard.
Oliver is an executive vice president with the Federal Reserve Bank of Atlanta and has been with the Bank since 1973. He is currently the director of the Retail Payments Risk Forum, working collaboratively with organizations across the payments industry to research and mitigate payments risk.
From 1998 to 2009, he was the payments product manager for the Federal Reserve System. In this capacity, he had responsibility for managing the Fed's check and ACH businesses nationwide. Earlier in his career, Oliver served as planning analyst, administrator of the Automated Clearing House, chairman of the Federal Reserve's Electronic Payments Implementation Task Force, manager and officer in charge of business development and check software, and staff director for the Federal Reserve System's Policy Committee for Financial Services. He also serves on the Federal Reserve Bank of Atlanta's Management Committee.
Oliver holds a bachelor's degree in math from the University of Nevada, a master's degree in information and computer sciences from the Georgia Institute of Technology, and an MBA in management from Georgia State University. He also has completed executive development programs at Harvard University and the University of Tennessee.
Mag-Stripe Debit and The Migration of FraudTRACY KITTEN: Payments technology is rapidly changing and in the United States discussions and debates are increasingly heating as regulators, innovators, and industry analysts search for more secure and convenient ways for consumers to conduct financial transactions. One Federal Reserve executive says it's time for the U.S. to embrace a more advanced and secure payments technology, also known as EMV chip and PIN. Richard, do you expect that migration to perhaps make the increase so dramatic that it could make sense for banks maybe in the next year to maybe take a more serious look at a move to EMV?
RICHARD OLIVER: Yes, two or three thoughts there, I certainly think that trend will be at the heart of justifying a harder look and further investments. It has to, and I don't expect that trend to stop. As we looked at the various issues of risks and fraud and the payment system here at the Retail Payments Risk Forum, we're able to see how the bad guys move, and they are going to move to the place where they commit it easily. So, I think that number is going to continue to grow.
I think the other thing that is a bit perplexing is the various numbers that you see in print on this particular topic. I think it's easy to find numbers on card losses that are published by the various card companies, but I don't think that's anywhere near the number that has to do with the total cost of this run. Whether it's the breach of Heartland and the huge cost associated with managing that breach, notifying people, replacing the cards and what have you, or whether it's the actual dollar losses.
Reporting Losses and Merchant Push For EMVOLIVER: There are also some issues, too, about who is reporting the losses. Some party in the chain may not suffer a loss, even though there's a big fraud attempt. It's pushed off to another party and maybe those parties aren't being inventoried and surveyed as much as the card companies; and I'm talking here, particularly, about the widespread merchant community. I know that an organization called the Merchant Advisory Group is in the process right now of conducting an extensive fraud survey with their members. So, I think part of the equation is, what is the real cost of fraud, and does the business case change, then, when you begin to get that on paper? I think that is the first place we're going to have to look.
I think also what's happening is there are a significant number of the very large retailers who are, in fact, quietly deploying today systems that are capable of dealing with chip and PIN. Now, some of these may be chip and PIN compact cards and some of them may be chip and PIN contactless-capable or even NFC (near-field-communications) contact-capable. But the fact they are even out there is not very widespread, in terms of knowledge, so it's hard to understand how big the bubble is. But I'm absolutely certain that growing fraud numbers will be a driver.
OLIVER: Yes, I think that's right. And when you look at the transition, some sort of dual provisioning of technology is almost impossible to avoid. But having said that, bringing it into the mag-stripe world as quickly as possible, sooner or later, it seems to me almost becomes a public policy issue. Somebody is going to have to put a stake in the sand and say, "Look, we just can't do this anymore." I think it will be interesting to see whether it surfaces to that level or whether the industry itself begins to come to the realization of trying to move and create some orchestrated programs. But it is important to point out that an orchestrated program doesn't occur in 24 months or 12 months. If you look at the card-reissuing cycles, and you look at the checkout technology cycles at retailers, this is really something that needs to be planned over a four-to-five-year period, as of certain dates and certain things will or will not happen. That is pretty much what Canada has done.
Reg E and Impact of Fraud On Debit UseKITTEN: I would like for a moment to separate credit-card fraud from debit-card fraud. The credit card companies have done a relatively decent job of deploying analytical tools and putting safeguards into place to protect consumers. Debit, on the other hand, is a little bit more vulnerable and poses more consumer risks, because of the tether between the debit card and the checking account. How do you expect increases in debit card fraud to change consumer spending behavior?
OLIVER: Well, that's a fair question. I think that in one respect, the consumer enjoys this protection with the debit card that comes through Regulation E, in terms of protection against losses. From that standpoint, whether it's debit or credit, the consumer has certain protections that don't necessarily let this get in to the consumer's pocket so deeply. But even though you might be protected financially, I think the hassle associated with debit or credit fraud is certainly something that people don't enjoy going through. I'm seeing more and more of a desire on the part of debit card providers to compete on this front. I think we all know that everybody is pushing debit. Debit numbers are going up. Somewhere in that chain, as debit-card fraud continues to arise, various providers along the chain are going to begin to suffer some pain. I've also seen the cost of those debit card systems rising, because now I'm seeing rewards programs attached to them, just like they are with credit cards, and that is going to raise the cost. So, there are several issues at play here that are working in opposite directions, but an increase in debit-card fraud, which would be, I think, the potentially anticipated outcome of staying with the mag-stripe, is going to change the math associated with whether or not this a good way to act.
Dodd-Frank and the Durbin AmendmentOLIVER: There is another thing that could change the math, too, and that is something included in the Dodd-Frank Act that many people don't even know about. It is called the Durbin Amendment. The Durbin Amendment assigns to the Federal Reserve System a responsibility to regulate debit-card interchange fees. In essence, creating some basis on which debit-card interchange fees should or could be established; and it also goes on to say that the Federal Reserve should pay attention to the fraud mitigation capabilities in the debit card system, and potentially even create standards there, and potentially even allow for a second interchange factor that would help pay for whatever effort it took to get up to those standards. How that whole process turns out and where the Fed comes out in terms of regulating interest rates could really change the economics of the debit card system, and potentially could get people's attention, with respect to investments that are being made in mitigating fraud. So, I think there is a lot that can be done there, but I think that particular thing could change the formula completely.
OLIVER: You know, at first I didn't think there was, and the Federal Reserve Bank of Atlanta, through my group called the Retail Payments Risk Forum and the Federal Reserve Bank of Boston have joined hands here to facilitate discussions on the issue of mobile in the United States. We've created an industry working group that's representative of the various players in the mobile ecosystem. We met three times this year and again in October. And what we're trying to do is help facilitate discussions amongst all the players to determine where mobile fits in to the U.S. payments landscape and how would it be justified. Is there a business case? And, basically, how might it best operate to meet the needs of all parties? When we started those discussions, I think I didn't understand that there was much of a tie between mobile and the issues of mag-stripe and EMV chip and PIN. Now, I believe that there is a tie. I certainly believe there is a tie between EMV chip and PIN and mobile, simply because of the technologies involved. While EMV chip and PIN has been implemented in Europe, for example, as a contact technology, where the card actually is passed through the machine and there is contact, card technology using chip and PIN is on the rise in many different forms and many different pilots. My assistant director has a sticker on the back of her phone that allows her to walk into a Starbucks or in certain convenient stores and tap a terminal and purchase things. And that is using a certain type of EMV technology.
EMV is also developing a contactless technology for near-field communications or NFC, which is the technology that will be used by the phone. So, consequently, the issue to me seems more of an issue of contact versus contactless EMV. It's really hard to think about how you would get to mobile NFC without either going through a phase or implementing some aspect of the EMV chip and PIN associated with cards.
A Leap To EMV and Dual Payments SystemsKITTEN: Now, when we take a step back and look at the payments landscape, a number of players come into view: the financial institutions as the card issuers, the merchants, which you've spoken quite a bit about, the consumers, the payment networks, the list goes on. Making a dramatic shift in payments technology, whether that be to mobile or directly to EMV, is going to be quite an undertaking, and some merchants have voiced concern in that area, saying they only want to upgrade their POS devices once. They only want to upgrade their systems once. And if a move to EMV is inevitable, they would rather just go ahead and make that move now and skip the mobile piece. How do you respond to that?
OLIVER: If you were going to start from scratch and create a vision that everybody could rally around, I think that would be a vision that everybody would rally around. Merchants have been very clear that they are frustrated by the potential need to move through two or three different technology changes on the way to what they see, potentially, as the ideal situation. Some studies that have been done recently by the Smart Card Alliance indicate that probably 75 percent of the cost of re-jiggering the system to allow chip and PIN technology in the United States is going to be born by the merchants. So, they are very cognizant of the costs here. They are looking for other people to help them with the cost, and they would sure like to avoid two transitions, because I think their normal trade-out cycles are in the vicinity of three to five years. Having said that, when you look at the implementation in Europe and the fact that they are not moving yet to mobile NFC, I think the specifications for a mobile NFC, the EMV specifications for that, are probably going to be finalized and released either late this year or early next year. Then pilots will ensue. There is a pilot plan for Nice (France) that will begin to get at this. You kind of wonder if you're not stuck in a world where you're going have to support at least two technologies simultaneously, and it may be that the challenge of doing that can be resolved by technologists. I know, for example, and you've seen it with MasterCard's and Visa's PayWave and PayPass systems that there are ways to do add-ons to your existing terminal systems, to allow those systems to support various types of technology at the same time. And maybe that will be the way we have to go. I don't know that most people realize, for example, that The Home Depot has already deployed chip and PIN technology into its terminal systems, that Best Buy and Wal-Mart also are doing the same thing. And somewhere along the line, if Wal-Mart is deploying contact chip and PIN and a move to contactless happens, then something is going to have to be done down for the terminals to handle both technologies. So, while I don't think I would want to be in their position of going through two transitions, it may be almost necessary to do one and half the other to get to where we want to go.
Tech Investments Come Before EMVKITTEN: Richard, before we wrap up, could you give us some closing thoughts about the direction you see the industry taking in the payments arena, generally, over the next 12 months.
OLIVER: I would like to make these comments in light of where we are right now in the financial crisis. As we see the thawing in the financial crisis area, certainly what we're learning is that banks have a wide range of projects lined up that had been forestalled by the financial crisis. They don't all have to do with payments, first of all, and they don't all have to do with customer-facing things in the payments arena, once you start talking about payments. I think Aite did a study that listed the top 10 initiatives that banks need to undertake in the wake of a financial crisis and one of them is just simply replacing core systems. When you look at the core payment systems that are in place in the banking industry today, they've been there for 15 years -- whether it's the core ACH system or the check-processing platform or the card systems. And one of the issues is getting them integrated so that a payment is a payment. One of the things that can happen today, if you recall, is that a check payment can be converted to ACH at the point of sale, or it can be converted for an Internet/Web transaction or what have you; and we're not allowing that for corporate payments or business-to-business payments today, because there are a whole bunch of protections associated with the check system, like positive pay, stop pay and fraud detection that are not transportable to ACH. So, integration of the back-rooms of these banks, I think, is going to be a big issue on their plates, from the technology standpoint, as they look forward into the years ahead. Having said that, as you want to replace your systems, there is clearly a trend to cut cost. There is a lot of consolidation going on. We're seeing partnerships and alliances in areas that used to be sacred cows; nobody would work with anybody else on it. So cutting costs is a big trend.
New ways to create transaction revenue is another one. The things that have funded the bank payment systems in the past, whether it's overdraft fees, whether it's return-item fees, whether it's card-interest rates, whether it's the float on checks, are all going away, either because of electronification or because of regulatory and legal changes that are being made in Washington. Now, as we view the work that's about to take place on interchange fees, I think banks are even more worried, because that's another big source of revenue. So finding new value-added revenue sources and services they can offer to their customers that are of value is going to be a focus. Most are probably going to be in the information-management area.
Then, finally, I think this whole mobile thing is a trend. Individual banks today are working with individual (mobile) carriers to try to create mobile payments options -- mobile banking options where you can use your iPhone as a browser to get to your home banking systems and do normal banking transactions. But there's going to be a trend to use it for payments also. That is going to occupy a lot of people's thinking as it relates to how they might partner better and resolve the formula for revenue sharing and cost sharing between the players and the mobile-payments ecosystem, which is a different group of people than we see in some of the other payment streams.