Fraud in digital age with m-payments

Dave Birch describes/links to this posting that explain how to do fraud via m-payment etc:
This is how it works: You buy a stored value card for X amount of dollars and a prepaid mobile phone. Next, you register with the m-payment service provider using a free anonymous e-mail account, your prepaid mobile phone number and the money on the stored value card. Using your mobile phone, you log on to the m-payment service provider and give them the number of the mobile phone to which you wish to transfer the funds from your stored value card. The m-payment service provider sends a message to the receiver's phone number asking where to transfer the money. The recipient can request the transfer to his stored value card and withdraw the funds from any ATM.

Phishing attempt at ABN AMRO

Automatiseringsgids reports on phishing attempts aimed at ABN AMRO. The Dutch used in the phishing mail was a bit rusty, so most customers immediately understood that it was a literal or automatic translator doing the work. Furthermore, the mail was sent a couple of times, suggesting that some of the phishers accidently pressed the sent-button a bit too early.

Sneak preview on PSD compromise in German web-article

See this article to conclude (if I understand correctly) what the political compromise is about the Payment Service Directive. Apparently some give and take occured for the issues strict speed for payments and strict regulation for non-banks.

And for those capable of reading German:
Für die beiden grössten Knackpunkte im Streit um einen SEPA-Kompromiss haben Vertreter der 27 EU-Staaten am gestrigen Mittwoch eine Einigung gefunden. Sie verläuft entlang der Kompromisslinie, die sich im Vorfeld abgezeichnet hat:
Die eine Partei (Deutschland et al.) akzeptiert die sogenannte T+1-Regelung, wenn auch in der mildesten Form. Transaktionen müssen demnach am Ende des nächsten Werktages ausgeführt sein. Denkbar wäre hier auch die scharfe Interpretation "am Anfang des nächsten Wochentages" gewesen.
Die andere Partei (Großbritannien et al.) lässt sich im Gegenzug auf eine schärfere Regulierung der Nicht-Banken ein. Von diesen wird insbesondere eine in der Höhe noch nicht festgelegte Sicherheitseinlage verlangt werden. Die deutsche Ratspräsidentschaft will diese Linie heute mit dem Europäischen Parlament abstimmen. Gelingt dies, könnte das Paket zur SEPA-Einigung beim Treffen der EU-Finanzminister in der nächsten Woche zusammengeschnürt werden.

Google moving in with e-money license

Following up on all the news of Skype, I was wondering whether or not major players such as Yahoo, Microsoft and Google were up to further financial business yes or no (see also this report on Microsofts hiring choice for financial services EMEA). If so, the most likely place for them to be active would be the UK, basis of Paypal (assuming Paypal has chosen its home based an a thorough analysis of the best regulatory climate or doing cross-border banking and e-money business).

So what do you get if you go to the FSA register search and type in....:
Yahoo - 433351 - Yahoo! UK Limited - insurance mediation - not much.
Microsoft - 209864 - Microsoft Online UK Ltd ; some stuff about Egg, valid until 31/08/2005
Paypal - 226056 - Paypal (Europe) Ltd, authorised, issuing electronic money,
Skype - nothing
Vodafone - nothing, also their small e-money license has disappeared from the radar.
Google - 462517 - Google Payment Limited, authorised, also for issuing electronic money.

Well, what would they be up to?
Can we conclude that Google have gotten themselves a license, and are 'forgetting' to tell us all about it. I've tried googling the question (as Google knows ;-)) but that didn't get any results. So I guess we'll have to wait and see for further announcements.

Meanwhile I may go about checking the Dutch central registers to see if they have similar stuff in their books.

PayPal Reports Nearly 35 Million Accounts in Europe

Payments News noticed the Paypal press release, outlining that they have 35 million accounts in Europe, which appears to be the biggest cross-border bank/payment institution/e-money provider of today, even if you estimate that only 10 million accounts will really be active. In 2006, PayPal processed $8.4 billion of total payment volume in Europe.

Skype to offer money-transfer system via PayPal

On quite another scale (compared to yesterdays announcement in Belgium), Reuters informs us that Skype will soon be offering payments, using Paypal technology. Both organisations are within the eBay umbrella of companies and the product will be revealed within a months' time. Planet Internet's assessment is that it is technically a quite simple integration effort, aimed at gaining further foothold in the migrant money market.

Yet, to gain real commercial foothold in that market, I think the Paypal/Skype proposition requires a reloadable pre-paid Visa or Mastercard (to be funded from the Paypal account). Everyone can then send money to the holder of that card who can withdraw money worldwide. Although I can also imagine a bunch of anit-money-laundering reasons for not going this last mile....

Banxafe for m-payments via the Belgian bank

The belgian banking/telco community has developed and launched m-payments that combine access to the bank account and holding a mobile telephone (see todays announcement here). I think it requires a smart sim somehow (so the customer who doesn't have one needs to get one in the shop). Automatiseringsgids informs us that one payment costs 25 cents to the consumer and49 cents to the merchant and that the minimum amount payable is 6 euro.

The flash animation for the product is quite amusing: (click here) and confirms a market positioning for the more than small-value payments. The payment functionality is branded: Pay2Me and the only company now accepting it is Pizzeria Arrivero (who undoubtedly dislike carrying cash).

Well, witnessing the highly succesfull current payment facilities of telco's, we can only hope the best for this initiative. It is built with high bank involvement, so it will have quite some hurdles, caused by bank regulation (identification, security, monitoring of transactions etc). Meanwhile the home-bred telco payments (paying for information, ringtones etc. from the pre-paid funds or from mobile account) will continue to eat up the real low-value market and may remain unregulated if the assumed Commission-telco lobby (described by the Dutch bankers on pages 11/12 of their reply to the Commission Enquiry into competition in banking).

Interesting book on how Europe works and cross-border payments became cheaper

This wednesday Mr Eppink, former civil servant in Brussels, will publish a book on how Europe really works. It should contain lots of behind-the-doors anecdotes, of which one is mentioned in this article. It outlines that supposedly Regulation 2560 came into being as a result of a talk of Commissioner Bolkestein with Mr Prodi (where Prodi fell asleep) but later on the chief of cabinet of Prodi outlined that the end result of the meeting was that cross-boder payments charges were to be made equal to similar charges for domestic payments.

Similar anecdotes show how it is not the Commissioners that are in charge but the civil servants surrounding them. Well, not really news of course. But it does make one wonder where the checks and balances are in Europe.

Talks on Payment Services Directive enter their last stage

According to an annotated ECOFIN-agenda of our Ministry of Finance, the Council of Ministers of Finance will at the end of this month be involved in discussing the Eu-political orientation with respect to the Payment Services Directive. The published writing makes it clear that no final text exists. There is still no agreement on important parts of the Directive and the Ministry makes it clear that if innovation is stifled too much and if the regulatory barriers are too much, they will not support the proposal.

Then again, anyone who was entering negotiations at the end of the month would of course say they wouldn't be able to agree.

ABN AMRO confirms talks with Barclays...

See this press-release in which ABN AMRO confirms exploratory discussions with Barclays plc: As part of its continuous strategy to explore value creation for all stakeholders, ABN AMRO confirms that it is in exclusive preliminary discussions with Barclays plc concerning a potential combination of the two organisations.

It's all very early day and may lead to nothing. But it does help the Dutch realize that the end of domestic banking and big Dutch banks is over. It will all be multi-domestic and/or cross-border in the end. And the upside of all this.... may be that once Dutch parliament realizes this, they will also stop asking their questions from the strictly domestic perspective.

More SWIFT news last week

This week the Dutch could witness more stuff on the SWIFT-case:
- further discussion and questions in parliament,
- continued quarrels between central bank and data protection authority
- banks planning a communication campaign to tell that customer data is given to US officials.

So that's some more ado about nothing.

The sillyness of banks telling their customer that their data can be read by us-officials is demonstrated by this text on the Dutch data protectors website:
Een organisatie hoeft de betrokkene ook niet te informeren als de organisatie de gegevens vastlegt of verstrekt op grond van een wettelijke plicht.
Translated: an organisation does not have to inform involved customers if the organisation stores or provides this data on the basis of a legal obligation.

I do hope that the Dutch sillyness stops here, because we're really wasting time and energy here.


Update: the siliness did unfortunately not stop: this saturday morning, Executive director Kohnstam of the Data protection authority threw even more oil on the fire in a radio programme. He found that the bank communication plans were insufficient..... but he also acknowledged that all data provision to US authorities was based on legitimate government rules. So how is he ever going to fine banks for not informing the customer in a case where his own data protection law says that there is no need to report customer data provision in cases that they comply with government rules?

I will stop reporting here (having listened to the full program); my conclusion is that this discussion is no longer about the law but merely about a data protection authority that wishes make a public point (regardless of content).

PBS and BBS merge card processing operations

See also the Finextra article:
Norwegian payments processor Banking and Business Solutions (BBS) and Danish payments body Payment Business Services (PBS) are merging their respective card processing operations to form a new company called Northern European Transaction Services (Nets).
Nets will offer card payment processing services in the North European markets and aims to increase annual volumes from three billion transactions to five billion transactions by the end of 2008.

BBS and PBS will each own a 50% stake in the venture and say Nets will also seek additional investors to fund further expansion in Europe. The new company will be headed by PBS EVP Klaus Frandsen.

Well, there was already one sheep (TAI/Interpay--> Equens) over the bridge, so more are bound to follow.

Payment Service Provider Ogone to go public

According to this Belgian website, the Belgian payment service provider Ogone (which processes nd routes Internet-payment related to e-commerce of 7000 web-merchants) may go public. It's founders and owners will earn a bit then. After which the Payment Service Directive will kick in and make their business model a bit of misery.

WestLandesbank and Click&Buy to make use of EPC-standards for cross-border payments

Finally there is some good news on SEPA, the single euro payments area. WestLB AG and Click&Buy most properly recognized that the standardised EPC-formats for payments can be made to good use in the future. So they published a press-release on that with the completely incorrect title: WestLB AG and ClickandBuy Simplify European Payments

Quite amusing as none of these companies were anywhere near the European Payments Council lately (where it all started) but still, it goes to show that the EPC-standards can be put to good use. Or as they would phrase it:
WestLB AG and ClickandBuy today launched the first Europe-wide pilot project on the future Single Euro Payments Area (SEPA). Until now companies and private persons in each member country have had to comply with a variety of legal frameworks in the payments field. Going forward, payments can be effected more easily and more cheaply throughout Europe via SEPA. Under the model project, WestLB and ClickandBuy will simplify European payments settlement at an early stage. The aim is to significantly reduce the administrative costs of companies operating throughout Europe.

Public letter by EPC on progress: delay of direct debit

This week, we saw the publication of a public letter by the European Payment Council. While it contained a lot of text on technical progress, the main message was that, due to the delay of the authorities to draft the Payment Services Directive, the market roll out of direct debit products (based on the EPC-direct debit standard) will also be delayed.

Interestingly, there's no mention of a new provisionl start date. So we have to do te math outselves. Let's assume that this summer, the PSD will be finished. Then, we need translation in 2 languages, so that'll be October before the thing is all clear. And add another 18-24 months to that. Meaning that at the end of 2009, the PSD may be implemented in a series of Member States.

And now, let's step back at the timing and planning of both EPC and the Commission
- EPC started in 2002 and took 2008 as a firm starting date; goal achieved while in the meantime the cross-border infrastructure was transformed to a full IBAN/BIC processing on the basis of Credeuro-convention,
- the Commission started thinking about the PSD in 2003 and took 2008 as the date of envisaged PSD-transposition; they'll end up with 2 years delay (if not more).

So which of the two is really slowing European integration down ?

SWIFT-transfers: did anyone ever really pay attention after 09/11..?

Todays Dutch NRC features an article where the boss of the Dutch data protection authority, Mr Kohnstam, states that he is going to fine Dutch banks if they will not tell their customers that infomation sent via Swift-transfers may be read by US authorities. This happens in the same week where the Ministry of Finance informed parliament that the central-bank settlement system indeed uses SWIFT-messages, which in principle might be read by police authorities in the US.

I think all the fuss about SWIFT and disclosure of customer data is a bit of cheap publicity nonsense. Members of parliament and data protectors are among the first to judge and condemn banks and central banks on their bad and secretive behaviour with respect to consumer data. And quite interestingly we see recently that central banks keep on publishing statements that they comply with all rules (suddenly acting as the best in class). In my view, all those seeking and responding to this publicity are basically re-engineering history. Was anyone of those people paying attention lately? Why are we so forgetful about 09/11 and the things we all decided were necessary to do afterwards?

Let's recall what really happened. Immediately after the disaster there was this anti-terrorist hype. Everyone feared ghosts around the corner. And thought that police and government would require additonal competences in order to fight terrorists. So on an international level, what happened was the drafting of additional special recommendations by the Financial Action Task Force on Fraud. So that we could better fight terrorists in the future. And I remember our Ministry of Finance explaining this to Dutch parliament in 2002 ! See the Minstry's website; the letter and documents are still out there (in Dutch):
In the aftermath of the September 11 terrorist attacks in the United States and the discovery of the wide geographic extent of the terrorist financial infrastructure that enabled them, governments moved quickly to create new counter-measures that could be specifically used to detect and dismantle such structures. Building on the existing expertise of the FATF, its members expanded the remit of the Task Force to include terrorist financing and issued a set of Special Recommendations to address the issue.

Of all those FATF-recommendations special recommendation VII was quite clear: all banks in all jurisdictions are to include name/adress of the sender of the payment, so that receiving banks (but mostly: the authorities in receiving banks' countries) can more easily provide originator information to their authorities. Litterally this recommendation, adopted in 2001 says:

VII. Wire transfers
Countries should take measures to require financial institutions, including money remitters, to include accurate and meaningful originator information (name, address and account number) on funds transfers and related messages that are sent, and the information should remain with the transfer or related message through the payment chain.

Countries should take measures to ensure that financial institutions, including money remitters, conduct enhanced scrutiny of and monitor for suspicious activity funds transfers which do not contain complete originator information (name, address and account number).

So let's resume the facts about the SWIFT-incident:
- yes, there was a terrorist incident in 2001,
- yes, there was a worldwide consensus between governments that a good and quick response was to demand all customer data to be included in payment transfers,
- yes, one might argue now that the response was unnecessary and too much of a good thing, but no one at that point in time dared to argue this, so the policy stands,
- yes, the recommendations were communicated to the world and local parliaments in 2001/2002 and later on,
- yes, this meant that police and local governments may have (had) access to originator customer data (which is nothing new by the way, as local governments always have access as a part of criminal proceedings, and provided they ask properly),
- yes, the US government exercised their rights as to accessing the data, and quite some other governments will have undoubtedly done the same,
- yes, the local governments did change their laws to transpose the FATF-recommendation into formal regulation (see EU regulation here).

So can anyone explain to me, why on earth banks would risk being fined in 2007 for not telling their customers something which is already in the public domain for more than 5 years? And don't most data protection acts contains rules that say that companies do not need to inform their customers about data transfers if these have their origin in a formal government rule? And don't we all know about those rules since 2001? That is, if we would read the stuff that the Ministries sent us....

All this public SWIFT-stuff is really too much ado about nothing. All public statements, opinions and questions are very cheap shots that regulators and parliaments throw at banks nowadays. If these players would really have guts, they would insist on no less than withdrawing FATF special recommendation VII. All else is mere gallery play to demonstrate political correctness, rather than honest concerns as to consumer data protection.

And more retailers into credit-cards....

While one part of the Dutch retailers seek to continue a battle against the credit-card, their own colleagues are making this a losing battle. Webwereld has an article that outlines that on-line retailer Wehkamp will start accepting ideal for webpayments. Furthermore, Wehkamp is planning the issuance of its own credit-cards. Which neatly fits their consumer lending business model.

New competition in payments to lead to more transparant pricing...

Many many years ago, payments between banks in the Netherlands were sent back and forth between banks without allocating costs to one another. The bacis principle being that it wasn't worth within a group of similar companies and similar interests to device a charging system to ask your competitor for the fact you processed something, while next week he would charge you in return.

Enter the giro-based Robeco on the scene (1975). Without having any offices they allowed customers to use the payment system to send them money for buying stock/securities. Which drained money from the system. But as those credit-transfers were free the banks felt it would be useful to introduce more cost-based pricing and interchange fees. Because in a world of different business model, imbalances between players require explicit cost-allocation and renumeration.

Fast forward to 2004-2006. Enter new players such as Argenta and DSB Bank on the Dutch banking scene. Having a full bank license but not operating with a lot of branches. So the cream off the market by offering customers high interest rates on savings and offering 'free payment accounts'. But there is a catch. It's not free for all. A customer will not be able to visit the bank (there are hardly any branches) but is required to do internet banking. And as forcard-usage, the new players lift along on international brands (without operating any ATM themselves).

This week Rabobank presented the loss-profit of last year. And FEM BUsiness featured an article that outlined that the competition for Rabo is increasing. Both in mortgages (where already 10 % of the Dutch mortgages is sold by a non-Dutch bank) and in payments (where new players offer free payment accounts). Of course Rabobank (having a dense network of branches) feels a bit annoyed by these new players in the payments domain. If such trends continue, they end up competing on price but also having only those customers left that do not do internet banking and need to revert to their physical distribution outlets.

So this week CEO Heemskerk of Rabo outlined to the press that Rabo will charge for all transactions related to the work for those new players. If any of the DSB- or Argenta clients will be using Rabo ATM's, either the customers or their banks will be charged for doing so. Because the days of free lunches are long gone.

Page on US Senate hearing on credit-cards

See this page dedicated to hearings on Credit Card Practices: Fees, Interest Rates, and Grace Periods.

Why?

Well, how about this...:

In 2001 and 2002, Wesley Wannemacher, our first witness this morning, used a new credit card to pay for expenses mostly related to his wedding. He charged a total of about $3,200, which exceeded the card’s credit limit by $200. He spent the next six years trying to pay off the debt, averaging payments of about $1,000 per year. As of last month, he’d paid about $6,300 on his $3,200 debt, but his February billing statement showed he still owed $4,400.

How is it possible that a man pays $6,300 on a $3,200 credit card debt, but still owes $4,400? Here’s how. Take a look at this chart. On top of the $3,200 debt, Mr. Wannemacher was charged by the credit card issuer about $4,900 in interest, $1,100 in late fees, and $1,500 in over-the-limit fees. He was hit 47 times with over-limit fees, even though he went over the limit only 3 times and exceeded the limit by only $200. Altogether, these fees and the interest charges added up to $7,500 which, on top of the original $3,200 credit card debt, produced total charges to him of $10,700

No more bank runs in the digital age... !

Last week I ran into this interesting bit of research of David R. Skeie of the the New York Fed. The title: Money and Modern Banking without Bank Runs almost says it all. We may need to revise our conceptual old thinking on bank runs, given todays digital age:
Nearly all of the theoretical bank run literature examines real demand deposits and describes historical bank runs based on currency withdrawals from the banking system. This paper adds to the Diamond-Dybvig model the features found in practice of nominal deposits, a goods market outside of the banking system and a clearinghouse for monetary payments and interbank lending. Together, these features in a modern economy imply that bank runs do not arise from pure liquidity-driven depositor runs, and neither deposit insurance nor suspension of convertibility is needed to prevent these runs.

Although one might conclude that we can do away with deposit insurance, the author des put his research into context to prevent such a hasty policy effect. Yet, it would make sense to reconsider the usefulness of deposit insurance for supervised credit-institutions in well developed economies. Particulary now that we see the emergence of P2P lending and P2P-banking. If we agree that all sorts of risks exist in life, why insure the money that is given to already supervised banks?

Webshopping still biased to domestic market

While Commissioner Kroes still maintains the bureaucratic and ideologic fiction that in a true Europe, retail payments and markets should all be panEuropean, Emerce reports in this artikel about the real-life and domestic world of E-commerce. Only 6 % of the Europeans does cross-border shopping. Which is of course reason enough for the Commission to start a consultation to find out how the holy grail of panEuropean e-commerce can be reached.

Now, what should come first: the e-commerce bit or the payment bit?

Continued retailer action against credit-cards

Remember my post of last december on an clear retailer action to attack credit-cards and interchang fees? It's now been three months since and the branche organisation for hotels/restaurants (Horeca Nederland) now brings in the boss himself. In what is in spirit and text almost a similar letter, Jeu Claes states in the Financieele Dagblad that credit-cards cost too much. Which goes to show that the retailer strategy is to keep on reminding the public, over and over, on stuff that appeals to the public, but essentially leads to only one thing: lower cost to the retailers themselves.

Which is their good right of course, but it is a bit double-hearted when actually one of the main strategies of Horeca Nederland to attract more members is to offer a serious ,5 % discount on average credit-card fees with major acquirers.