Chip and PIN Online

It’s easy to become blasé about internet shopping, but e-commerce statistics continue to astound. According to IMRG, global online sales volumes in 2010 amounted to €591 billion, an annual growth rate of 25%. Even in the relatively mature UK market, e-commerce volumes grew a very healthy 18% to €70 billion. Payments Council statistics paint a similar picture: in 2008, e-commerce accounted for 8% of all debit card and 20% of credit card spending in the UK.

This is of course great news for the card payments industry; or is it? Looked at another way, the share of e-commerce accounted for by card payments has been eroded dramatically over the last ten years from close to 100% at its outset to probably less than 50% today. Reliable statistics are difficult to obtain, but a 2010 survey by DIBS for the European Payments Council across eight European countries found that cards were the preferred online payment method for only 42% of respondents overall, but with marked differences between countries. In the UK, PayPal now accounts for a whopping 19% share, whilst in the Netherlands a form of bank transfer called iDeal is the most popular method with 40% share.

This should be a source of concern for the card schemes and issuing banks, especially since the main reasons for payment choice, according to DIBS, are security (62%) and convenience (50%), qualities traditionally strongly associated with card payments. It is surprising, therefore, that a solution which is both highly secure and reasonably easy to use has not been more widely adopted by the industry.

This solution, which in the absence of any established naming convention I am going to call “Chip and PIN E-Commerce”, is simply a linking of Remote Chip Authentication (RCA – MasterCard: CAP; Visa: DPA), with 3D Secure (MasterCard: SecureCode; Visa: VbV). Making this link and coordinating these two developments appears to have been difficult for the industry.

3D Secure has been steadily promoted by the card schemes as a secure e-commerce solution and is now fairly well established; for example it is now used by about 70% of UK online merchants. It is a reasonably good solution – certainly a huge improvement over the alternative of no cardholder authentication – but there are drawbacks. Firstly it is another password to remember. Secondly, because the password is static, it is vulnerable to hacking or phishing attacks, and it cannot be used over the telephone.

RCA – using chip and PIN with a personal card reader to generate a One-Time-Password (OTP) – has meanwhile enjoyed widespread success as a solution for secure online banking. Over 40 million RCA card readers have been deployed in Europe by many large banks, such as Barclays with its “PINSentry” device.

With “Chip and PIN E-Commerce” the cardholder uses RCA to generate an OTP which is treated as a 3D Secure password by the issuing bank. Simple! This is highly secure (strong two-factor authentication with an OTP), convenient (only the existing PIN to remember) and easy to extend (to payments over the telephone, digital signing, PIN-less authentication, etc – the latest development is the use of Display Cards which generate the OTP without the need for a separate reader). To date it has been deployed by all the main Belgian banks working together, and by Nordea in Scandinavia. But I’m not aware of it being rolled out by any UK banks, and it does not seem to be aggressively marketed by the card schemes. For what it’s worth, I think that’s a mistake!

Nick Collin, Banking Automation Bulletin, May 2011