Canh Tran (Rippleshot)

Which Mobile Payment Platform Will Win the Battle Against Fraud?

August 14, 2015         By: Canh Tran

The race to launch the next big mobile payment application turned into a full out sprint after Apple Pay debuted in the fall of last year. The four front-runners – Samsung Pay, Apple Pay, Android Pay and CurrentC – are all competing for market share in a crowded and quickly changing payments space. So, what differentiates them? And which, if any, will be the answer to the growing payment card fraud problem?

Given the attention around the mobile payments race, it’s worth noting that Apple Pay is the only system that is currently fully launched. Samsung Pay is presently in trial in South Korea, Android Pay has completed a trial and is waiting for launch, and CurrentC will be launching a limited trial of their own in Q3 of this year.

The differences between these platforms, however, go much deeper than their expected launch dates. While Apple Pay and Android Pay are incredibly similar in their capabilities and the technology behind each transaction, Samsung Pay and CurrentC operate in very contrasting ways. Samsung Pay, with its Magnetic Secure Transmission (MST) support, is the exact same technology that current magnetic stripe card terminals have and could very well be the most widely supported platform if it were deployed today.

That said, the upcoming industry-wide switch to support EMV chip cards in October could render most MST-only terminals nearly extinct as all merchants will need to provide chip card readers, otherwise be held responsible for fraud chargebacks that emanate from out-of-date terminals.

Unlike the other three platforms, CurrentC is banking on bypassing credit and debit cards altogether, unless they’re store branded. They’re hoping customers are comfortable enough with linking their checking accounts directly, and then plan on using QR codes on either the POS terminal or the customer phone to authorize an ACH transfer direct from the bank to the merchant. It is, however, worth noting that during an initial test of CurrentC last fall, the platform suffered a breach of customer data.

But CurrentC isn’t the only one that’s suffered security issues. When Apple Pay first launched in the late fall of 2014, it was plagued with fraud as hackers easily took advantage of the banks’ weak authorization processes and loaded stolen card information onto their own iPhones.

Apple has steadfastly held that all cardholder verification steps are up to the individual banks, and that cards are not allowed to be added to Apple Pay until they are cleared by their respective issuing banks. Since then, many banks have transferred this verification step over to their customer call center, but hackers have found ways to exploit that process as well.

According to mainstreet.com, hackers are now porting user mobile phone numbers over to their own devices, answering the verification call and continuing to easily load stolen card info on their devices.

We have yet to hear of different or more secure on boarding processes to be expected from Samsung Pay or Android Pay, though more support from either to help banks with the verification process would likely be met with overwhelming accolades.

What has been grossly overshadowed by the fraud and data breach problems, is that all of these mobile payment platforms have developed unique ways to protect account numbers from being compromised during transactions. All four platforms tokenize account numbers before the transaction is initiated, to prevent merchants from ever receiving the actual card or bank account numbers. This will go a long way toward preventing mega-breaches such as the likes of Target and Home Depot.

What these platforms won’t ever do however, is eliminate payment fraud altogether. As we learned in the Trustwave Global Security Report this year, ransomware attackers see an average of a 1,425% return on investment for their efforts. The likelihood that they will be deterred by tokenized account numbers or fingerprint verification are slim. This new technology is only a very small piece of a comprehensive payment security and fraud detection strategy, and should be considered as such.

 

Samsung Pay Apple Pay Android Pay CurrentC
Launch Date Current in trial in South Korea. U.S. launch expected September 2015. October 2014 Late summer 2015 Limited trial run in Q3 2015
Compatible Devices Galaxy S6 and S6 Edge iPhone 6, iPad Air 2 and iPad mini 3 Any Android device that’s NFC compatible Unclear, but will likely have the broadest compatibility, since it’s only an app.
Payment Technology Supports NFC, butalso Magnetic Secure Transmission (same tech magnetic stripe cards require) NFC NFC POS terminals that can deliver and read QR codes
Confirmed Partners Synchrony Financial, First Data, MasterCard, Visa MasterCard, Visa, American Express, Bank of America, BMO Harris, Chase, Citi, Capital One, among dozens of other financial institutions American Express, Discover, MasterCard, Visa, Bank of America, Navy Federal Credit Union, PNC, Regions, USAA and US Bank So far, no deals have been struck with major card issuers.
Merchant Support Estimated 30 million merchants worldwide (expected to be the most universally accepted mobile payment platform, due to the MST technology that doesn’t require a new/upgraded terminal). Currently over 700,000 locations (it launched in the fall with a little over 200,000 locations). A list of stores is available on their website. Currently over 700,000 locations, along with hundreds of aps (viewable here). MCX the company responsible for CurrentC, is made up of dozens of the country’s largest merchants.
Security Samsung Pay uses Knox (Samsung’s own mobile security software) and ARM TrustZone. They also use tokenization to ensure account numbers are protected. Tokenized device account numbers are stored on a chip on the specific device (and not on Apple servers). For each transaction, the device account number along with a security code are used to process the payment. Card numbers are encrypted, and a unique tokenized account code is generated for each transaction. The only notable difference is that Android Pay stores this information in the cloud. CurrentC requires the user to link up his or her checking account for direct ACH transfers. Like the other payment platforms, tokenized account numbers are sent to process the transaction.
Onboarding & Authentication Scan or type in credit/debit cards (bank authentication required – though it’s not clear what that process looks like). Cards can easily be scanned or typed in. Authentication process falls on the bank. Difficult to tell, since the service isn’t live yet, but presumably will follow a similar process as Apple Pay and Samsung Pay. Unsure on how CurrentC will work with banks to authenticate the account data being uploaded to the app.

 

– Canh Tran- CEO & Co-Founder, Rippleshot

Canh Tran is an entrepreneur with over 25 years of experience focused on big data and predictive analytics. Throughout his career, Canh has worked with large-scale data such as retail point of sale, payment transactions, credit, social and search information to solve sales, marketing, fraud, and credit problems.