Mobile Payments: Magnetic-Stripe Cards will be as Obsolete as Audio-Cassette Tapes by 2017
SEE LAST PAGE OF THIS REPORT Howard Mason
FOR IMPORTANT DISCLOSURES 203.901.1635
August 9, 2013
Mobile Payments: Magnetic-Stripe Cards will be as Obsolete as Audio–Cassette Tapes by 2017
- Magnetic storage media are obsolete, and there is a strong case that magnetic storage of payment account information (on the stripe on the reverse of a payment card) will give way to digital storage on a microprocessor “chip” just as the magnetic storage of music (on a compact audio-cassette tape) gave way to digital storage.
- Indeed, to avoid liability for fraudulent transactions, merchants must install point-of-sale (“POS”) technology for chip-enabled payment technology by October 2015. Of course, merchants could install “contact” terminals that accept only card payments and not the “contactless” terminals using the near-field communications (“NFC”) technology necessary for “tap and pay” phone payments. But it is hard to make a business case for this given:
- All leading smartphones in the US, with the (likely temporary) exception of the iPhone ship with NFC technology because of non-payment applications such as information exchange and device-pairing with radio frequency identification (“RFID”) tags.
- Digital wallet developers are levering NFC capabilities, along with the location- and time-based awareness of most smartphones, to create software such as Apple Passbook which integrates mobile payments and marketing. The benefit to customers is that loyalty rewards can function like “branded currency” – i.e., a cash-substitute in a specific brand context.
- Through the Isis standard (to be rolled out nationally later this year), leading banks (COF and JPM) have removed a commercial impediment to digital wallets by coming to terms with leading carriers (T, VZ, and T-Mobile) over the terms under which payment account information can be stored on a secure-element of the SIM card; it is lack of access to the SIM card for these carriers that limited the uptake of Google Wallet.
- We expect $50 billion of mobile payments in 2017. We acknowledge this may seem aggressive given the $500 million total in 2012 (substantially all at Starbucks) but agree with McKinsey that structural change happens slowly until it happens quickly (see Exhibit).
Exhibit: Structural Change in Newspaper and Music Business (Source: NAA, RIAA, McKinsey)
Magnetic Storage Media are Obsolete: US Magnetic-Stripe Payment Cards are an Anomaly
Just as the storage of music transitioned from magnetic (on a compact audio-cassette tape) to microprocessor (accessed via iTunes, for example), so we expect the storage of payment account information to transition from magnetic (on the black stripe on the reverse of a traditional credit card) to microprocessor (accessed via Apple Passbook, for example). Of course, a microprocessor “chip” does not have to be in a mobile ‘phone; it can also be embedded in a payment card as with the Exxon SpeedPass card.
The US is a laggard in the shift from magnetic-stripe cards to chip-equipped cards which are widely used overseas following a common “EMV” standard established by Europay, MasterCard, and Visa. At the beginning of the year, one industry executive (Mike English who directs product development at Heartland Payment Systems) made the point rather memorably: “The US is the last bastion of the magnetic strip. Every other country and every other continent, with the exception of Antarctica, has moved over to EMV”)
Chip-equipped cards may be “contact” cards which are inserted into a suitable merchant terminal (rather than “swiped” as with a magnetic-stripe card) or “contactless” cards which use near-field communications (“NFC”) technology to communicate with merchant terminals: a customer waves a chip-equipped card (or chip-equipped mobile ‘phone) over an NFC-enabled pad attached to a merchant terminal. The chip is identified using radio-frequency identification (“RFID”) technology. A “contactless” customer experience, whether on a card or ‘phone, is sometimes referred to, apparently without intended irony, as “tap-and-pay”.
The Chicken and Egg Problem
Typically, technology shift in a two-sided market (here banks controlling payment accounts and merchants seeking access to them) can face a “chicken-and-egg” problem: banks will not invest in putting chip-based technology in the hands of customers to make payments until merchants invest in putting chip-based technology at the hands of cashiers to accept them. Below, we address how this problem has been solved in the US so that the transition to chip-based technology will now happen quickly.
With the solution of the chicken-and-egg problem, we agree with comments made at the beginning of the year by the PCI Security Standards Council, an organization which establishes standards for the storage, processing, and transmission of credit card data: “You’re probably looking at two to three years before you begin to see EMV really becoming ubiquitous out there. It’s a rather slow conversion over to EMV, but it’s definitely coming”. Furthermore, as discussed below, we expect more than 80% of merchants to have NFC-ready terminals by 2017.
Given the adoption of NFC-enabled technology has disappointed up until now, we acknowledge that our positive view and associated forecast for $50 billion in mobile payments by 2017 may seem disproportionate to the $500 million last year (substantially all at Starbucks). However, we agree with Mckinsey that “structural changes often happen quite slowly … until they happen very quickly (see Exhibit 1)”.
Exhibit 1: Structural Change Can Happen Slowly Until It Happens Quickly
The Merchants are Chicken
“The retail point-of-sale represents a point of convergence for smartphone-initiated payments, social networking and electronic couponing, but it won’t happen if retailers are expected, on faith, to absorb the costs of making it work” March 2011, Douglas Bergeron, then-CEO of Verifone
Visa has forced the hand of the merchants. If they do not invest in EMV-compliant POS acceptance technology by October 2015, a liability shift will go into effect. Specifically, non-compliant merchants will become liable for the costs of card fraud, estimated at ~40 cents per $100 of purchase volume; presently, and for EMV-compliant merchants after October 2015, these costs are borne by banks.
Of course, merchants can adopt the EMV chip-based standard with contact terminals rather than the NFC-ready contactless terminals necessary for mobile payments. However, we believe the US will largely skip the use of contact chip-equipped cards, which are the standard overseas, and migrate directly to contactless NFC-enabled technology. Given merchants have to upgrade POS infrastructure for EMV-compliance by October 2015 and given the chance consumers will prefer to pay with mobile ‘phones before the natural next upgrade cycle (after 7-10 years), it seems hard to make the business case for contact terminals over contactless terminals. Regardless, leading suppliers of POS hardware,Verifone and Ingenico, include NFC capabilities in all new terminals.
Isis Came First
The merchant choice over whether to meet EMV standards through using contact-terminals or contactless-terminals is critical to the future of merchant payments. Without contactless terminals, consumers will need a hardware accessory to attach to their phones and insert into a contact terminal; this is the opposite of convenient. It is not surprising, then, that the banks are looking to shape merchant choices and the Isis-standard, and national rollout later this year, for mobile payments is decisive.
As discussed in our August 5th report “Mobile Payments: At the Tipping Point”, NFC-enabled un-accessorized ‘phones can, from a technology standpoint, be used as payment devices in place of chip-equipped cards provided there is a contactless terminal. However, there was a commercial impediment: banks and carriers could not come to terms over access to a secure-element on the SIM card for storage of payment account information. Google gained access for ‘phones running over the Sprint and Nextel networks, but not for ‘phones running on AT&T, Verizon, and T-Mobile networks which
Fortunately, the Isis partnership of these three carriers with JPM and COF has overcome the commercial obstacle, and we expect the national rollout of the Isis standard later this year to be the critical catalyst for mass adoption of mobile payments.
NFC-Enabled Mobile Phones
“It is the sum of many possible uses for NFC rather than one single killer application that make the technology compelling for smartphone vendors today. Once developers gain experience with NFC and get access to a larger installed base of compatible handsets, we can also expect to see entirely new use cases not yet imagined” Andre Malm, Analyst at Berg Insight, June 2013
If they are to invest in contactless terminals, merchants need to believe that handset makers will put NFC-enabled ‘phones in the hands of customers. Fortunately, this is not a stretch: with the exception of the iPhone, all high-end handsets in the US are already NFC-enabled and there is a strong case that substantially all handsets will ship with NFC capabilities by 2017 if not before.
This is because of the non-payment applications of NFC technology including information-sharing between ‘phones (as popularized in the “bump” commercials of Samsung) and device-pairing for a Bluetooth or WiFi connection. For a smartphone to be paired with an item via NFC, the item needs to carry an RFID tag. For now, these tags are the exception rather than the rule (as in Nokia’s “treasure tag” application, for example). However, as the cost of RFID tags declines with printed electronics, it is possible they will be a standard accessory; this item-level intelligence, of course, will increase the utility of, and hence business case for, NFC-enabled ‘phones.
From Magnetic Stripe to Chip-Equipped Cards
The traditional approach to identifying a payment account at point-of-sale (“POS”) is for the customer to carry a card, issued by the bank maintaining the payment account, with payment account information encoded on a magnetic stripe; swiping a “mag-stripe” card through a card-reader at a POS terminal transfers the account information to the merchant. The cardholder then authorizes the transaction by signing (in a signature-authorization system as for credit cards and some debit cards) or by entering a Personal Identification Number (in a PIN-authorization system as for other debit cards); increasingly, for some small transactions, there is no authorization needed.
In signature-authorization, paper receipts provide an audit trail for reversing transactions in cases of “charge-back” (where a cardholder wants to unwind a transaction perhaps because the purchased product is faulty) or fraud (for which the card-issuing bank is liable) when a card is stolen or the associated payment account otherwise misappropriated. There are savings available in the handling of charge-backs and fraud when electronic records take the place of paper records so you would expect the payments industry to shift towards PIN-authorization and create incentives for retailers to install the necessary POS acceptance-technology (in this case PIN pads).
This did not happen until the Durbin Amendment took effect in 2010. Indeed, the perverse incentives associated with “interchange”, a fee paid by the “acquiring” bank (and typically passed on to the merchant) representing a merchant in a card transaction to the “issuing” bank representing the cardholder, caused issuer banks to favor signature-authentication (notwithstanding its higher fraud and charge-back costs) and use rewards to incentivize cardholders to prefer signature-based cards. The reason is that the interchange on signature debit product was higher than that on PIN-debit products (see Exhibit A1). Now that the Durbin Amendment has had the effect of equalizing interchange across the two authorization methods, regulated banks have shifted volume to PIN-based products in order to capture the savings on fraud and charge-backs.
Exhibit A1: Until Durbin Effect in 2010 Interchange higher on Signature Debit than PIN Debit
Mobile and Other Contactless Payments: From Mag-Stripe to Chip
The critical difference between traditional card payments and “contactless” technologies, including mobile or phone-based payments, is that the payment account information is stored on a chip rather than on a magnetic stripe. The term contactless is used because, in contrast to the swiping of a traditional mag-stripe card through a card reader attached to a merchant terminal, a chip-based payment device (whether a contactless card such as the Exxon Speedpass or a mobile phone) can be waved over a pad attached to a merchant terminal; memorably, if somewhat erroneously, this is referred to as “tap and pay”. A chip-equipped card can also be inserted into some terminals in a “contact” transaction but, obviously, this is not possible for a phone-based transaction unless the ‘phone is outfitted with an accessory that can be inserted into the terminal.
The chip exchanges information with the terminal using radio waves in a near-field communications (“NFC”) protocol. There are several important implications, particularly for security and for the integration of payments with loyalty programs, of this shift from a magnetic storage medium to a chip:
- First: A chip can comfortably store information about multiple payment accounts, including loyalty accounts for example, so that assuming a suitably-designed digital wallet application customers can easily select from, or combine among, multiple payment options just as they can online (see Exhibit A2). The days of the Duetto card from Starbucks (launched in 2003 and discontinued in 2010) which had two magnetic stripes to allow customers to pay either using a Visa account or a store-based account linked to a loyalty program are behind us; loyalty programs can be truly integrated into payments with a mobile system in a way that was simply not feasible on a mag-stripe card.
Exhibit A2: Integration of Loyalty Program and Payments on Chase-Amazon Card
- Second: A chip can store dynamic information, such as updating account balances, whereas a mag-stripe can store only static information such as a payment account number. This mean the merchant terminal can write information to your payment or loyalty account so that on a ‘phone for, example, a digital wallet application can provide a real-time balance.
- Third: It is harder, although not infeasible, for a payment account to be fraudulently accessed by cloning a chip than by cloning a mag-stripe. Indeed, because of this, all merchants will be required to install contactless terminal by October 2015 that comply with a common Europay, MasterCard and Visa (“EMV”) “chip-and-PIN” standards whereby account information will be stored on a chip and transactions authorized with a PIN. This shift from mag-stripe to NFC-enabled chip-and-PIN technology is quite independent of the potential for mobile payments and customers who do not use ‘phones for payment will use chip-enabled cards.