The Financial Services Club's Blog

PayPal’s Tenth Anniversary

I wrote an indepth analysis eighteen months ago about PayPal’s 100 months birthday and now they’re celebrating their official tenth anniversary, so I thought I would add a small addendum. Although I say it’s a small addendum, it’s quite an interesting one.

Basically, I was updating some old slides about PayPal and thought that I should track their number of users over the years, as they do publish these numbers. First of all, I looked up the last published quarterly results from PayPal on the eBay website.

In their latest company presentation, published June 16th, they have these figures:

• PayPal operates in 190 markets using 17 currencies
• A third of people in the UK have a PayPal account
• Over 100,000 websites accept PayPal in Europe

Read more ...

Arguing about the Head and the Tail

Anita Elberse has created a great discussion in the Harvard Business Review this week about the Long Tail, the theory expounded by Chris Anderson, editor of Wired Magazine. 

The theory goes that you can make as much money as an online retailer from the 80% of specialised products that sell occasionally, the tail, as retail merchants make from focusing upon the limited best-sellers in the head of the sales line.

Anita states:

"In 2006 just 20% of Grand Central’s (book publisher) titles accounted for roughly 80% of its sales and an even larger share of its profits."

She also goes on to look at Rhapsody, the online music store, and finds:

"The top 10% of titles accounted for 78% of all plays, and the top 1% of titles for 32% of all plays."

As a result, she concludes that:

"For Chris Anderson, the strategic implications of the digital environment seem clear. 'The companies that will prosper,' he declares, 'will be those that switch out of lowest-common-denominator mode and figure out how to address niches.' But my research indicates otherwise."

Chris Anderson has already posted a response on his blog:

"She finds the top 10% of titles (out of more than a million in that data sample) accounted for 78% of all plays, and the top 1% account for 32% of all plays. That sounds pretty concentrated around the head, until you reflect, as she notes, that 'one percent of a million is still 10,000--[...]equal to the entire music inventory of a typical Wal-Mart store.' 

"This is a good moment to remind everyone of the normal definition of 'head' and 'tail' in entertainment markets such as music. 'Head' is the selection available in the largest bricks-and-mortar retailer in the market (that would be Wal-Mart in this case). 'Tail' is everything else, most of which is only available online, where there is unlimited shelf space. 

"So in the data she cites, the head of the online music market represents 32% of the all plays, and the tail represents 68%.  That's certainly no challenge to the Long Tail theory; indeed, it's even more tail-heavy than the data I cited in my book (probably because I used a more generous estimate of 50,000 tracks for Wal-Mart's inventory)."

Nothing like a good argument is there?

Why am I bothered?

First, because the Long Tail is an important theory about modern retailing.

Second, because it plays to the heart of online channels and why we virally network socially through blogs and virals in a networked world.

Third, and most important for readers in banks, is that there is a Long Tail in banking that's emerging through prepaid cards and mobile telephones.  Take note of the views of both Anita and Chris, as they are crticial discussions in how to make money in these markets.

Fortress Europe's Independence Day?

I attended a long discussion yesterday about High Value Payments (HVP).

I wondered why we even bothered to discuss and delineate between Low Value Payments (LVP) and HVP these days. Surely, we should just talk about Real-Time Payments (RTP), near RTP (sub two hours) and D+n. Alternatively, urgent versus non-urgent with T+n, dependent upon your view of the world.

Having introduced enough acronyms in my opening paragraph to confuse a rocket scientist, I think I can see why we talk about HVP versus LVP … it makes us sound more interesting and knowledgeable.

Read more ...

Who knows their IBAN and BIC?

A question came up in today’s EBA sessions for Joe Pawelczyk, Vice President for International Relations at CHIPS, the American Clearing House for over $2 trillion of wire payments each day. The question seemed quite simple: “Why doesn’t America use IBANs for their bank account numbers, as all of Europe has now standardised on this?”

Joe looked a bit non-plussed and piped up with: “Because we cannot define a stadnardised account number.”

Well, a standardised account number is an IBAN (International Bank Account Number) and BIC (Bank Identifier Code) isn’t it?

Oh wait.

I just noticed.

IBANs and BICs are not standardised.

Read more ...

Zimbabwe keeps going thanks to remittances

According to a press release from the International Association of Money Transfer Networks, Zimbabwe's economy keeps going thanks to mobile remittances, even with an economy where inflation is currently running at two million percent and is expected to reach six million percent by the end of June.

Less than 10% of the population is employed and a huge food crisis looms ahead.

The answer is that the remittance market has been the lifeline for thousands in Zimbabwe.

A remittance company operating in Zimbabwe says that up to US$1.5m a day moves into the country in remittances. Western Union is the principal company but can only operate with the blessing of the Reserve Bank. The rest operate on the 'parallel' market, meaning the financial market running at the true value of the Zimbabwean dollar, rather than the declared Government rate of exchange, which today is running at 50% of the market rate.

The parallel market has been allowed informally by the Government to function being a useful source of badly needed foreign exchange. Remittance operators sell their foreign exchange to the Reserve Bank in exchange for Zimbabwe dollars at exceptionally good rates - in effect colluding with those who seek to destroy them.

Not surprisingly normal money transfer channels have suffered - as huge swathes of regular clients have moved to the unregulated systems. Apart from the fact they get a better rate of exchange, under the normal KYC rules they have also been fearful that their identities would be passed to the Government which at a time of intimidation and retribution could bring danger to themselves and their families.

Prepaid – just another payment type?

I have been attending a conference on Prepaid this week, one of the largest of its kind with over 300 delegates all focused upon this burgeoning market. The fact so many are attending says something, and most of these attendees appear to be from organisations other than banks. Transit authorities, mobile telephones operators, governments, utilities, retailers ... oh yes, and MasterCard, Visa and AMEX.

Initially, I thought: what's the big deal about prepaid? It's just another payment type, like credit and debit isn't it?

Well, maybe not.

Read more ...

You can’t hide anything anymore

A year ago, Wired magazine had the front page headline: Get Naked. It made me buy the magazine and turned out to be a fascinating article all about how the world is now transparent. Nothing can be controlled or hidden anymore. You cannot keep anything secret. It will all get out there somehow, some way.

Since this article, I’ve noticed how true this is. Embarrassed politicians, corrupt traders, covert chief executives and their cohorts should all be afraid. Very afraid.

You cannot hide anything anymore. Information will out, whether it be through Facebook, blogs, emails, instant messaging, chatrooms, text messages … you name it. Information will out.

Here are a few examples of how disruptive these trends are proving to be.

First, there is the case this week of the Bear Stearns executives who thought they could share ideas secretly, but the truth has come out. Their cunning plan was to send emails between their wives email addresses. No-one will ever look there will they? Their mistake was that they believed email to be private communications and did not realise that all of their emails go through host internet service providers who keep a copy. Oh dear. Everything is always retrievable this way.

Second was the very sad case of Tim Russert, NBC’s news anchor who died of a heart attack in the studios on June 13th, shortly before going on air. The usual form when such a tragic event occurs is to let the news channel break the news first, out of respect for the family and friends who should have been contacted beforehand. Within twenty minutes of Mr. Russert’s passing however, Wikipedia had his obituary online; a good forty minutes before the station broke the news.

Third was the recent example of Prince Harry in Afghanistan, whose presence was meant to be secret but was leaked online by an Aussie magazine and, before you knew it, everyone knew he was there. Result: he had to leave.

Fourth, is the news of the launch of Phorm in the UK. Phorm is being trialled with 10,000 UK BT broadband customers to make advertising more relevant. It allow sites to run ads based on individuals surfing history, rather than the content of the page being viewed.  The system works by using data about a customer’s internet address and website movements, to build a profile of the customer. 

Bottom-line: whether you like it or not, everyone will know everything about you, your preferences, your habits and needs. Oh, and don’t think privacy is an issue here. As Phorm’s CEO says, all data is held randomly and no-one’s name or computer address is revealed or identified. Oh yes.

The fact is that any bank, retailer, government, consumer or citizen who wants to hide their business these days will find it incredibly difficult.  Maybe the only way to do this is to be a digitally excluded and avoid having any information about you being held online.

Become a nobody.

Even then, digital recluses are not immune to being found digitally.

Take the example of one of my relatives. They are in their 70’s and have no digital accessories. They have never used a computer, have no email address and do not want to use the internet or anything digital. They have a typewriter, a telephone and a television, and that is as technology oriented as they want to get.

I stunned them the other day by googling their name and address, only to retrieve a variety of documents that gave me a profile of who they are and what they do.

Nothing is secret.

Banks are no longer able to keep secrets.

I regularly look up banks and bank groups in social networks and online chatrooms and find chats such as:

J: “What do you love most about working here?”
S: “The end of my shift.”

So don’t try to hide anything anymore.

Work out how to use blogs, social networks and viral chat as an aide to business rather than a threat. There are ways.  More on that another day.  However, today, to show how much of a threat not being on the internet can be, you only have to look at this week's battle of Britain’s largest retailers.

On the evening of June 17th, and all day through June 18th and 19th, Sainsbury’s online shopping website broke down. As a result, the 90,000 customers who shop online for groceries with Sainsbury’s each week could not spend their average £80 per transaction online. That means the grocer lost £1.5 million during the period their website was down. They also offered £10 compensation to 20,000 distressed shoppers who could not shop to make up for it.

This was really bad timing as the CEO of Sainsbury had just announced that first quarter results in a presentation to the City aon18th June, saying that “the online operation is continuing to perform well, with sales growth at over 40 percent”.

Equally, rival supermarkets started running Google advertisements within 24 hours of the issue, offering free deliveries and £5 off if you opening accounts with them instead of Sainsbury.

Imagine if your online banking systems went down for two or three days, or an exchange’s fault tolerance failed for 72 hours, and you can imagine this blood bath in banking.

In this cut-throat market, where everything is transparent, real-time, ultra-competitive and ultra-accessible, banks – like these internet retailers – must start to leverage internet capabilities far more than today, to fight harder and win more business.

Using blogs, viral and related services to gain business, whilst attacking any weaknesses in competitor’s website operations will be the standard, and the quality of the bank’s internet services team operations, and online marketing competencies, will separate the winners from the losers.

Europe lacks a Leader

I don’t write about politics, because I am not a political creature. However, I felt compelled to write about this subject after Europe’s soul-searching over its identity since the Irish threw out the EU Treaty.

The fact that the Constitution and the Treaty are unwanted does not de-stabilise our banking efforts under the Payment Services Directive and SEPA, or does it? 

The fact that citizens do not want more European integration, and are happy to just have EMU, is fine for those creating the Eurozone, isn't it?

Read more ...

An Oyster that’s a Diamond, London’s Contactless System

Intriguing discussions today about the Oyster Card in London. This is the contactless card operated by Transport for London (TfL) to allow everyone to travel across the London public transport system without using cash. It’s basically a prepaid contactless card, like the Octopus Card in Hong Kong or the New York Subway Card.

Oyster was launched in 2003, and I love stats so here’s a few from Transport for London (TfL):

• 70% of all rail journeys in the UK start or finish in London, and TfL operates 8,000 buses and 278 bus and rail stations, rising to 500 stations by 2010;
• these stations and services are used by 6 million bus passengers and 3.4 million on the trains and underground every day;
• 80% of these customers use an Oystercard for these journeys, and there are over 18 million Oystercards issued;
• Oystercard is accepted by 4,000 retail outlets, mainly newsagents, with 20,000 Oystercard readers deployed across the network; and
• the readers read and write over 10 million contactless taps per day.

This makes Oystercard the largest contactless card programme in Europe and, possibly, the world*. 

All 20,000 readers will be upgraded by 2010 to accept NFC MIFARE chip-based Oyster Cards, EMV and EMV-variant cards, and ITSO cards (Integrated Transport Smartcard Organisation).

The benefits of the programme are multiple in terms of streamlining travel, reducing queues, minimising cash handling, reducing the possibility of fraud by customers and cash theft by staff, and generally improving the customer experience. Having said that, the biggest benefit is the £60 million reduction in annual operating costs for TfL of the ticketing system since implementing the Oystercard. This includes the interest earned on prepaid monies sitting on the float.

Therefore, there is a critical strategy to increase the card usage by the extensions of working with Visa PayWave and MasterCard PayPass, the NFC standards committees, and by collaborating with organisations such as Barclaycard, O2 (the mobile carrier) and other partners.

The challenge the Oyster spokesperson left us with at the end, is that they are upgrading the readers to read and write EMV for payments cards and NFC for mobile services for the unbanked. What Oyster would like to see is that EMV incorporate NFC standards or vice versa to make this easier.

Now there’s a thought.

* The Octopus system in Hong Kong is the most mature of these subway systems with twice as many people using the card as live in Hong Kong, generating over US$12 million per day in transactions.

Exchanges fight over speeds and feeds misses the point

It is fascinating to watch the fight that is going on between the traditional exchanges – Deutsche Bourse, Euronext and London Stock Exchange (LSE) – and the new guys – Chi-x, BAT, virt-x, PLUSMarkets, Boat, Turquoise, NYFix Millennium, NASDAQ OMX, Equiduct …

The fight is over liquidity, trading, order execution, pricing, clearing and settlement.

In fact, on that note, we should throw in LCH.Clearnet, Clearstream and Euroclear in their battles with EuroCCP, Rainbow and friends.

There is no doubt that MiFID has been a trigger for change, although the resulting changes are yet to be seen. In other words, we are seeing change, but just do not know the long-term landscape, winners and losers as yet.

The reason for mentioning this today is two-fold.

First, LSE came out yesterday saying that the new guys had to fight on some other ground than latency. Second, Turquoise’s leadership – Eli Lederman, CEO and Adrian Farnham, COO – are addressing the Financial Services Club next Thursday with their views of what it takes to win in the future.

Read more ...

EBAday, Stagflation and Survival of the Fittest

EBAday, or is that days as it is now 2 days, is upon us next week. This is the annual jamboree for the Euro Bankers Association to celebrate the arrival of SEPA, after much anticipation since EBA days started three years ago.

This year it is in Helsinki on Wednesday and Thursday of next week, and I have the honour to chair the plenary session with Werner Steinmüller, Head of Global Transaction Banking at Deutsche Bank, and Mark Garvin, Chairman of JPMorgan Treasury & Securities Services International. Coincidentally, these are the two sponsor firms of EBAday this year.

In planning this plenary session, we have discussed a few ideas and decided to get away from SEPA specifics, as that’s covered in all the other sessions, and talk about the big picture. And the big picture focuses upon how the markets have changed since the last EBAday in Rome last year.

Just a year ago, all of us Europeans arrived, bright-eyed and bushy-tailed, and calm in the knowledge that we had built the best payments processing infrastructure plan in the world. We were refreshing our systems and services, pricing and products to capitalise on this new pan-European model of processing, and all felt the investment in SEPA may have been painful but at least it was worthwhile.

How things change in a year.

Shortly after EBAday 2007, August 17th hit Wall Street and the global collapse of liquidity and credit created the worst massacre of the markets seen since 1987 and the Big Bang. This collapse was created by poor lending practices and complex derivatives, rather than by some conspiracy of markets.

In the year since, we have seen the collapse of Northern Rock and Bear Stearns, the embarrassment of UBS, Citibank and Merrill Lynch with deposed senior executives across the board, and the shock of Société Générale’s rogue trader, who may have caused this old French bank to end up merging with BNP Paribas.

Boy, how the markets have changed in a year.

We now see investment bankers facing hard times and selling second homes or pawning their Aston Martins and Rolex watches, as their wives divorce them before poverty strikes. We see hedge fund managers faking suicide leaps of terror in order to evade jail. And we see the word ‘stagflation’ rearing its ugly head everywhere in the papers.

Stagnating growth with inflationary prices is the fear of everyone as that created the boom-bust cycles of the early 1980’s, and massive economic uncertainty.

We are also seeing other scares including fuel rising to levels of unprecedented pricing, partly spurred on by the credit crisis; gold prices reaching levels never seen before; food riots in countries whose people are dependent upon rice, grain and other basic crops; and worse.

In hindsight, we can all rationalise these events and say it was all predictable but, a year ago, none of this was even in our radar and, even if it were for some, it was never as bleak as it is now.

How times change.

The only good news is that London’s property prices are still surging amongst the uber-riche, with the new residential development, One Hyde Park, selling for an average £6,000 (€8,500, $12,000) per square foot!  The estate agent, Knight Frank, says: “it’s the best selling, highest price scheme anywhere in the world”, with average price for an apartment of £20 million. I was going to buy one, but think I’ll have to leave it as most of the buyers are apparently oil, gold and food commodities billionaires.

In light of these changes, it will be interesting to see how the manner, thinking, strategy and dialogue of the payments community has changed when we meet next week in Helsinki.

Have any of these issues scuppered Europe’s plans for payments processing? Have we put back the launch of SEPA Direct Debits (the Rule Book is just about to land on my desk as we speak)? Is SEPA Credit Transfers working? And is the reachability of the EBA operation proving to deliver?

I don’t intend to second-guess these ideas here, but I do hope to see you in Finland next week. Bearing in mind that this is taking place on nearly the longest day of the year in the land of never-ending sunshine, we can at least spread a little bit of sunshine on the markets and cheer us all up.

Mobile phones do fry the brains

Conclusive proof that mobile phones do fry the brains ...

... or is this a viral video to promote popcorn eating?

In case you're wondering why I posted this, it's because this video has been copied around the world.  There are videos on YouTube that show similar experiences in Asia and America. 

The original French video has been watched by over 3 million people in 10 days. 

It's making headline news in the media too and shows that you really must be more aware of using the mobile and, ideally, wear a wireless headset.

The trouble is that if you try to pop popcorn using your mobile at home with your mates, then nothing happens. 

Maybe that's because this is just a spoof video made by a wireless headset manufacturer called CardoSystems.

There's a marketing lesson in there.

I.T. Architectures: why Technologists have lost the plot

It’s really tough dealing with technologists.

It is like the old discussion of the businessman in the hot-air balloon who is lost. He spies a chap on the ground and asks if he knows where he is.

The guy looks up and says, “you are about 35 feet in the air, supported by a vehicle comprising cloth and ropes, and filled with helium.”

The business man looks puzzled and says, “you must be a technologist.”

“Wow”, the guy says. “I am. How did you know?”

“Because what you have told me is technically accurate, but of absolutely no use to anyone.”

“Ah”, says the guy. “You must be a businessman.”

“I am”, says the businessman, “but how did you know.”

“Because I was minding my own business and you asked me to help you out, so I gave you assistance in the best way I could, and now you blame me for the mess you’re in.”

Ouch. Business and technology folks really don’t get on well.

The reason I raise this today is because I spent yesterday with a bunch of technologists.

The focus of the discussion was SOA, Service Oriented Architecture.

Is that Customer Service Oriented Architecture, I hear you ask?

No, it’s Web Service Oriented Reusable Objects for Interoperability Architectures.

Oh dear.

At this point, most business people have left the room. 

Now, I think I know what they were trying to say, as I used to be a programmer, but if I were a business person then I’d probably have no idea what they were talking about because you end up using a bunch of acronyms and words from foreign lands, such as SOA, SOAP, J2EE, BPEL, XML, CDL, MDDL, FpML … you name it.

No wonder business folks would rather smell a monkey’s armpit than talk to a technologist.

The real point is that through SOA, firms claim you have re-usability of code to be more agile through being able to plug and play and evolve into highly flexible systems. 

Apparently, according to the technologists, no business person wants to hear the plea for investment in this stuff however.  Investing in building future, flexible architectures for their technology operations just falls on deaf ears.  As a result, they tell me that SOA is an IT investment, not a business investment. Business people don’t want to hear about it, and so it’s snuck in under the regulatory change, compliance and discretionary investment budgets.  There is no budget for ‘re-architecting’ the bank.

I do not like that view, as I think SOA should be a business dialogue and investment, not something hidden under the radar.

What the business people need are business conversations.

First, a business discussion around why SOA is felt to be important.

Second, a business discussion about why SOA will deliver business benefits.

Neither of these discussions normally comes up with a technology group because we talk about objects, modules, standards and technologies. However, there is a business dialogue that could be proposed, and it would go something like this.

First, how to position SOA for the business crowd.

Well, imagine you are building a house. Most house builders employ architects to ensure the foundations and structures are right. Most house builders also employ one architect, not many. 

So you first of all need an enterprise architect to create the overall architecture for the bank’s systems.

Relating this to house building, you cannot have multiple architects as then the doors and windows, joists and beams might all be different. Sure, if you want a quirky house then that is fine but, if you want a great house, you give the job to a single expert architect.

So that’s what we need in a systems context.

We’ve built many systems over the past fifty years without an architect involved. Designers and developers for sure, but house designers and developers create buildings that are inappropriate for secure long-term structures.

This is the point of SOA. It allows us to create a technology house built as a long-term secure structure for the bank, rather than some higgledy-piggledy labyrinth.

The reason why this is important today is that we have technologies today that conform with international standards. In other words, if our systems were built like a house today, we would be using global standards for cement, bricks and glass, whereas much of what we had before was built using local materials that were good, but not for global structures.

We have global structures and this means we can rationalise into a global architecture using standardised materials. That’s why we need an enterprise architecture, an enterprise architect, and a clear long-term secure technology infrastructure to evolve the bank into the future with agility, flexibility and simplicity.

The second piece of the dialogue is that, if we did this, what’s the benefit to the bank?

This should again be clear, and it’s not woolly benefits about re-usability and agility. Nope, it’s about reduced cost and increased revenues.  Using standard materilas means that if you’ve created a program for a card payment once, for example, you can use that program again and again and again.  A little like if you manufacture a 6x4 glass window frame once, you can manufacture that frame 1,000 times for zero cost overhead.  That's what we can do today with systems.

And that’s the real point. Scale efficiency, standardised materials, re-usability and repeatability. This way you minimise costs and maximise returns.  Before, many banks had systems that hinder efficiency becuase they used non-standard materials and cannot be re-used, replaced or redesigned easily.  So what we had before maximised costs and minimised returns.  That's why we need to re-architect.

In this context, an illustration of approach with results always helps, so I’ll pick on HSBC’s CIO, Ken Harvey, who was interviewed by Financial Services Technology magazine last month.

In the article, it states that he was “tasked by the Board with the goal of cutting HSBC’s unit processing costs by 10 percent each year, and managing an annual IT budget of around £2.5 billion.” This led to a complete redesign and rationalisation of HSBC’s global systems infrastructures and applications, with results that leverage global scale. Mr. Harvey states that the “benefit has been 85 percent on the revenue generation side, with only 15 percent on the cost reduction side.”

The whole point is that, by rationalising systems and making them reusable, you can scale the efficiencies and leverage the capabilities of a single design, many times.

I’m not saying that this discussion resolves the fact that technologists and business folks don’t get on well, nor that SOA is the right and only way forward, but technology folks should realise that by sneaking IT rationalisation into the IT budget, they are missing a trick.

The trick they are missing is that they are behaving as a silo function without getting business buy-in. Without business commitment, IT investments such as SOA, will just be some half-cut, half-hearted effort, rather than realising the results that could have been unleashed if this was delivered by the enterprise, for the enterprise.

Payments fraud: the word from the Fed

There was a lot of buzz around this year’s Federal Reserve Bank of Chicago’s Payments Conference, “Payments Fraud: Perception versus Reality”.

First, there’s the sheer numbers involved. For example, it is estimated that each year $3.5 billion worth of chargeback losses occur in the USA through fraudulent transactions, according to Orbitz.

Bruce Cundiff of Javelin Research had some particularly interesting stats, that show identity fraud is on the decline in the USA from 10.1 million cases in 2003 to 8.1 million today, with the cost reducing 12% during this period from $56 billion to $45 billion. Ouch! $45 billion losses through identity fraud is still pretty steep, with the average amount defrauded in each case coming in at just over $5,500.

Read more ...

Governments will force us into biometric banking

Picking up on one of the points made in the debate this week about identity and authentication that it is the government’s responsibility to manage identities, I was kind of surprised by this view. This view stated that banks have no control over identities because governments issue identities in the form of passports, driving licences and social security numbers. Therefore, it is the government’s role to protect identity and ensure that unique identities are provided to citizens.

This was called a ‘cop-out’ during the debate, namely that we are abrogating our responsibilities if we think that it is governments who should manage identities.  I think there is a more important point being made here.

If it is the government’s responsibility to issue identities, is it also the government’s responsibility to manage those identities? As most governments, especially the UK’s, seem more leaky than a rusty bucket when it comes to data protection, should they really manage our unique identities?

If not governments, then who? Banks? Corporates? Citizens?

Equally, if governments are responsible for issuing identities, then we will very soon be dealing with a full-scale rollout of biometric banking.

After all, most Asian, European and American government agencies are now issuing biometric identities. Biometric passports and identity cards are proliferating everywhere.

Go into Hong Kong and the government identity card that has been in play since 2003 has been biometrically based.

Fly into America and stick your finger up at George Bush, as well as your thumbs, hand and face. All are captured by immigration as foreigners move across their borders.

Fly through Europe these days and many airports allow you to sign up for iris recognition programmes to speed you through the customs hall.

Soon, all of these developments will come together for biometric passports, identity cards and driving licence standards to try to avoid forged or stolen documents to be used as identity.

And, as these developments occur, all banks will start to accept biometrics as identity for authentication.

In fact, I am amazed we are not seeing this today.

Sure, I’ve seen major roll-out of fingerprint banking systems in some countries – Mexico, India and Indonesia in particular – but this is because most citizens in those countries do not have government issued identities. They don’t have passports or driving licences, therefore the banks take it upon themselves to issue identities, in the form of biometric bank debit and credit cards.

Just look at Grupo Mello, ICICI Bank and Bank Danone in each of these countries (Mexico, India and Indonesia respectively) and they are all using fingerprints for identity management, as it is the easiest way to manage and secure authentication. And they are doing this in a mass, scalable and proven system.

Grupo Mello in Mexico for example, manage over 8 million biometric accounts and hundreds of thousands of fingerprint authenticated transactions each day.

But in developed economies, biometric banking is completely missing today.

The nearest you get is the full-scale rollout of palm-reading ATMs in Japan.

These ATMs don’t read palms by saying: “I predict you will be coming into some money”, but they do identify the unique vein pattern every human has running through their hands. The blood and veins in your palm therefore form a unique and accurate recognition system.

These ATMs have been rolled out by Hitachi and Fujistu in some numbers, and are generally accepted across Japanese society. The only prohibiting factor for other economies – America and Europe specifically – is the cost of such systems.

But biometric banking is coming.

Alongside mother’s maiden names, PINs, signatures, cards, key fobs, watches and whatever else you happen to have with you, your bank will soon want to check your eyeballs, face, fingers or other data to authenticate the transaction.

This means we will move from something you know and something you have, to something you are.

This triangulation of authentication – what you know, have and are – will combine to tighten the grip against fraudsters.

One day, within five years, most customers will stick their fingers up at their banks to authenticate as happily as they do today to demonstrate their unhappiness.

Just keep your finger on the pulse and watch that space.

Postnote: I have heard all the arguments against biometrics – they cut your hands off, they force you at gunpoint to the ATM, they pick your eyes out like Minority Report etc. These fears have been proven true in early trials in some countries, such as South Africa and Brazil, but by recognising a hand is alive by using latent fingerprints or by using CCTV at the ATM, you manage these issues such that these behaviours are minimised over time.

This house believes our authentication and identification methods work

Last night’s debate, “This house believes our current authentication and identification methods are good enough”, was a healthy one and focused primarily upon card authentication in retail transactions.

We started with the case for.

The motion was proposed by one of the major card processing firms, who said that the card firms are trying to do more than enough to protect cardholders.

They talked about the Chip Authentication Protocol (CAP), a method of making card present even when remote by asking the cardholder to use a calculator style terminal to authenticate.

This program has just been rolled out in the UK and means that each time you make an online payment, you enter your PIN plus a special one-time system generated code into a special card reading terminal.

In addition 3D secure, the pop-up window where you enter a unique and personal password for a transaction, provides an additional layer of security, as do the use of IP addresses and other location-aware services.

Combine this with Chip & PIN and all the other ways in which we are protecting cardholders, and our current authentication and identification systems are good enough.

This view was refuted by a representative of one of the credit reference agencies, who claimed that authentication goes further than just card protection and must look at the process for client account opening. This process is subjected to rules for AML and KYC which are clearly flawed, as they are totally reliant upon paper. These paper-based processes are easily subjected to fraudulent activity because utility bills, driving licences and even passports are easily forged.

Back to the proposal and the UK’s leading payments authority made it clear that we are doing what we can with what we have.

Governments are responsible for issuing identities – passports and driving licences – and we need better management of this part of the process. In other words, the identity card systems are not within our control, and we can only use systems that are within our control.

Given this constraint the industry has achieved a lot and, where we have control, it works. In fact, where it is within our control, we go as far as we need to go in order to satisfy our appetite for risk. The whole authentication process therefore is built around acceptable levels of risk.

Finally, the representative of a firm that provides remote identity confirmation determined that the views of both proposers were flawed. Chip & PIN had had a little success when first introduced, but was proving to be broken already as the systems is regularly undermined by petrol station attendants.

The CAP reader is a good idea, but means that anyone who gets our card, PIN and CAP reader can now spend excessively online too, making our online purchasing protection even more compromised.

Meanwhile, 3D Secure is a neat idea, but only 10 million of the UK’s 140 million card users have signed up for it, which shows it is not that great.

In other words, for all the efforts of the industry, the customer is not buying into our authentication processes and therefore they must be flawed.

Following these open gambits, with the proposers saying that we’ve done what we need to do and the opposers retorting that it’s not enough, the floor was open for debate.

Points were raised, such as the fact that claiming identity management is the government’s job is a cop-out, isn’t it? Waiting for the government to issue ID Cards will be a long wait, and surely the industry should do some work beforehand?

There were questions about the speed of change, and why the industry takes so long to implement and improve processes. For example, with mobile and biometric authentication available, why are we not implementing these systems?

The answer was that the industry can only move as fast as its slowest players, which is not necessarily the banks, but the merchants and retailers who must also be brought on board. Many of these retailers are SMEs and mid-caps, and so embracing all UK business in the process is a key barrier to speed of change.

Surely customers also have some responsibility for their own protection of identity. The fact that customers expect the industry to make them secure, without taking any responsibility themselves, is just ludicrous.

But customers only like security when it’s convenient, which is why CAP and 3D Secure are proving tough to make a success. 30 percent of UK consumers are abandoning online payments due to the inconvenience of CAP for example.

Is there a point at which we move from customers being idiots and responsible for their own protection versus the industry being at fault, because we should have educated the customer to be more responsible?

The evening wound its course to conclusion, with the conclusion being the motion: This house believes our current authentication and identification methods are good enough.

All those in favour?  27%.

All those against?   63%

The motion is rejected.

Digital Identities? We haven't got a clue!

Today is a day that’s all about authentication, identification and verification.

First, I have been asked to make a speech at a payments conference all about how to minimise risk; and, second, we have a meeting of the Financial Services Club this evening, in the form of an Oxford Society style Debate with the motion: “This house believes our current authentication and identification systems are good enough”.

I’ll report on the latter topic tomorrow, but thought I would write a summary of my speech just to see how it plays out.

Read more ...

Are banks really responsible for the oil crisis?

With oil prices falling to as low as $10 a barrel in 1998, rising to $72 in 2007 and now hitting $139 on Friday, what is happening? Forecasters are now saying that oil may break over the $200 per barrel price barrier before the end of the year. Will this bubble never burst?

Sure it will, but in the meantime everyone is laying blame on someone else.

UK Prime Minister Gordon Brown blames the Organisation of the Petroleum Exporting Countries, OPEC. What a load of baloney. OPEC were responsible for price-fixing and shorting production in the 1970's, which caused the last crisis, but now these countries produce only about 4 in 10 barrels. If anything, OPEC has tried to maintain fair pricing for the past three decades, rather than fixing.

OPEC therefore blames the Federal Reserve's policies on the dollar in light of the credit crisis. Did Greenspan and Bernanke mess up this badly? Some would say yes, as the price of oil bounces unendingly upwards on each day of bad news USA. Friday's spike up was caused by the sharpest one-month rise in American unemployment rates since 1986.

But then the Fed and other investors, such as George Soros, blame speculators and hedge funds. Everyone's trying to make a quick buck out of commodities such as oil and gold in light of the credit crunch.

So who's right and who's wrong?

Read more ...

The best call centre sketch ever

I've seen lots of call centre comic moments, but this one made me laugh out loud, and I mean LOUD. 

Starring David Schwimmer and Simon Pegg, the 2006 film Big Nothing has this little 4-minute skitt:

I'm sure that all those Mumbai, Manila and Guangzhou call centre operators, as well as those in Manchester and Minneapolis, will relate to this.

Banks versus Consumers - who wins?

Front Page of Business Week today: Banks versus Consumers - who wins?

The focus is upon credit cards and debt collections and, with American credit-card debt hitting a record high of $957 billion in Q1 2008, up 8% from the previous year, according to Federal Reserve data, this is a growing market.   One of the market leaders in debt collections is the National Arbitration Forum (NAF), used by many banks to chase up delinquent accounts.

The article then goes into a few statistics:

• NAF handled 33,933 collection arbitrations in California, from January 2003 through March, 2007; of the 18,075 that weren't dropped by creditors, otherwise dismissed, or settled, consumers won just 30, or 0.002%, of these cases; 
• NAF employs 1,700 freelance arbitrators - mostly moonlighting lawyers and retired judges - who handle some 200,000 cases a year, most of them concerning consumer debt; and
• NAF’s presentation to clients tells them that, in cases in which an award or order is granted, 93.7% are decided without consumers ever responding and that only 0.3% of consumers ask for a hearing (the rest just tussle through the debate via mail).

As a result NAF is becoming the target of a legal action with consumers claiming that rather than arbitrating, they are purely acting on behalf of banks. For example, 1,400 Virginia residents claimed that they had been promised, in writing, that they could appear at hearings before an NAF arbitrator but that the law firm representing NAF, Wolpoff & Abramson, failed to arrange the hearings. The case was settled in favour of the residents.

Interesting article.