What is the future of the credit and debit card payments system?

Yogesh Sapkale 09 June 2011

While a majority of countries have shifted to more secured card payment systems like EMV plus PIN, the US, China and India are still not ready to ditch the magnetic strip card system. However, due to newer payment systems, the future of the card payment system looks bleak

Credit cards and debit cards, or automated teller machine (ATM) cards, commonly referred to as plastic money, are undergoing tremendous changes across the globe. In order to improve security and reduce frauds in plastic cards and card payment transactions, authorities, researchers and innovators are searching for newer ways. This has resulted in many countries shifting to the more secure Europay, MasterCard and Visa (EMV) chip cards with personal identification numbers (PIN).

However, countries like the US, China and India are still using the older magnetic strip cards (MSDs) and signature, or PIN verification, for plastic cards transactions. In the US, the resistance to change is primarily due to the cost of migration to EMV, as profitable revenue channels associated with current interchange fees do not offset the cost of re-carding. In China there is a strong legal framework to handle financial frauds, which acts as a deterrent to fraudsters.

On the other hand, over 99% of the total cards issued in India are based on magnetic strips. Interestingly, about 90% of the existing point of sales (POS) terminals in the country, managed by 21 acquirers (among them Axis Bank, HDFC Bank and ICICI Bank), can accept EMV chip cards and PIN. However, not all ATMs are equipped to do the same. Only 50% of the existing ATMs with minimal software and hardware upgrades can accept EMV chip cards. The rest of the ATMs would need major hardware upgrades, or even replacement, to enable EMV chip card acceptance.

A majority of the lenders, who have installed around 70,000 ATMs across the country, are also not keen to spend on upgradation. There is a reason for this. According to Reserve Bank of India (RBI) rules, any cardholder can use another lender's ATM free of cost, for up to five transactions each month. This means, that many lenders are serving many who are not their customers, through ATMs, without earning much revenue from these transactions. On the other hand, lenders earn commission on each transaction through the POS terminals.

In the period between March 2010 and February 2011, the total spends value in India on credit and debit cards, including e-commerce, interactive voice response (IVR) and mail-order/telephone-order (MOTO) transactions, was Rs1.13 lakh crore. In the same period, India had 22.2 crore debit cards and 1.8 crore credit cards, while there were 5.6 lakh POS and around 70,000 ATMs installed.

The industry reported a loss of Rs13 crore due to stolen and counterfeit card frauds. While the fraud-to-sales ratio came at 1.4 basis points (bps), early cases of domestic counterfeit and skimming are on the rise.

Certain issuers such as Citibank and State Bank of India issue Maestro debit cards. Maestro debit cards are magnetic stripe cards that require a PIN to be entered at the POS terminal. Citibank's experience has been that card usage levels are significantly lower when a PIN is required to be entered at the POS terminal. No wonder that a majority of cards require the user to use the PIN only for ATM transactions and not at POS.

A few large card-issuing lenders like Citibank, ICICI Bank, HDFC Bank and SBI issue EMV chip cards, while for most other banks the host systems are not ready and have not been certified for issuance of chip card. However, these banks are issuing chip-based cards to customers who frequently travel abroad and have high credit limits. In addition, all these cards use signatures as a second authentication instead of the global practice of using PINs.

However, MSDs and PIN are susceptible to skimming or counterfeit frauds. This has forced many countries to adopt the EMV chip card and PIN, which protects against skimming and lost and stolen card frauds. Based on international experience, EMV chip card and PIN migration typically takes more than five years, depending on the market size.

According to a report by a "Working Group on Securing Card Present Transactions" of the Reserve Bank of India (RBI), there is a need to put in place a series of measures to strengthen the payments infrastructure and ecosystem in the country. Inferences drawn from case studies clearly indicate the need to have a much stronger authentication mechanism and reiterate the need for a second factor (2FA) for card present transactions.

"In the absence of 2FA for POS transactions there is a possibility of the fraud losses increasing by more than 200% in a single year, in the event of a sharp increase in fraud incidents in the country. There is also a possibility of POS FTS (fraud-to-sales ratio) increasing by around 200 basis points in one year under adverse conditions," the report said.

The report discusses new systems like EMV chip cards with PIN that has been adopted by many countries and enhancing the current MSD card system with help from biometric identification.

"Aadhaar (issued by the Unique Identification Authority of India - UIDAI) authentication using biometrics, provides a strong 'Who you are' factor of authentication. This can be combined with a second 'What you have' or 'What you know' factor to achieve strong customer identification at the point of sale."

While the option to use biometrics from the UIDAI database looks good, in practice, due to insufficient feasibility tests, it may not be a viable option. "The working committee considered biometric, or UID, as the second factor in one of the solution sets; however, the decision to adopt this would depend on various factors like the number of UIDs issued to the population which transacts through cards, the error rates, authentication network capability to handle transaction volumes, network capability to handle enhanced transaction size and acquiring infrastructure," the report said.

Therefore, while on paper the use of biometrics as 2FA may sound feasible, its uses would be limited at specific locations. In this situation, EMV chip cards and PIN look like the future proof system, despite the higher costs, for card-based transactions. Nevertheless, this may not be the last in payment transaction systems.

According to Bhavin Mody, senior product manager, ElectraCard Services, EMV chip and PIN cards require the industry to make a huge investment in the card issuing and acquiring infrastructure. In addition, it involves replacing all the MSD cards that have been issued, which in itself could be a huge exercise.

"EMV chip and PIN is surely a long-term solution, but it would require a very long time (3-5 years) to implement. One more advantage, which EMV chip cards have, is that this solution is extendible to offline modes of payments. This would enable mass transit payments and payments requiring fast-moving queues," he said.

One of the options available for payment ecosystem players to consider is contactless smart cards. Transit payments, like metro rail, buses, toll and loyalty applications and micro-transactions might accelerate the move to contactless cards in India. Contactless transactions are known to be significantly faster and more efficient than magnetic stripe or contact cards.

Last month, internet search giant Google launched 'Google Wallet', which allows people with compatible mobile phones to pay for goods and services in shops by just waving their phones. (http://googlemobile.blogspot.com/2011/05/coming-soon-make-your-phone-your-wallet.html). Google Wallet is based on near field communication (NFC) protocol. According to Juniper Research, by 2013, one in five smart phones in the world would have NFC capability. NFC is also available as a MicroSD card or sticker.

Ashok Shankar, Solutions Deployment Manager at NCR Corp India Pvt Ltd, said, "Financial institutions along with regulatory authorities and technology companies could come together and use a holistic approach to address the security risk and other aspects by adopting technology such as NFC that significantly eliminates potential frauds and benefits the entire eco-system including Customers, Banks and Technology providers."

Such technologies will be a huge advantage in India, which has 24 crore debit and credit cards and 58.1 crore GSM mobile subscribers, as of April 2011.

"The nation wide adoption of the NFC technology could be viewed from a 3-5 year roadmap. The first priority however, is to be given to safe guard customer's trust in the ATM channel and his investments with the bank. We believe that now is the best time than ever as consumers continue to demand more and are looking for enhanced self-service experience," Mr Shankar added.

In November last year, the National Payments Corporation of India (NPCI) launched its much-awaited interbank mobile payment service (IMPS), which has the potential to change the payments scenario in the country. According to bankers, this system could revolutionise the retail payments process and even overtake the number of payment transactions carried out through cards and the internet.

However, while there are nearly 60 crore mobile phone subscribers, there are less than 20 crore 'active' bank accounts. Although on record there are about 31 crore savings bank accounts, many of them are either multiple accounts or they are not operational. IMPS could help revive these accounts.

Unfortunately, the initial response for IMPS from lenders and customers has been lukewarm. In the absence of information and awareness campaigns from the lenders to the end user, the IMPS may not take off, as per expectation. Moneylife has been trying to get access and use IMPS for subscription services since December last year, without any luck so far. The reason is no one from our bank or branch seems to have complete knowledge about IMPS.

In the end, there is not a single payment transaction system that we can label as future proof. While the EMV chip card and PIN provide good options for safe and secure card payments, other systems which use mobile phone may turn out to be the dark horse.

You may also want to read...