National Security

< back to the Future Banking Executive Corner page <

In 2002, the banking industry made the announcement that it was going to replace signature verification at the point-of-sale with the use of a personal identification number (PIN). Although other countries around the world began using PINs on debit cards in the early 1990s, these were domestic only systems. In 2003, the UK issued the first chip and PIN card built to an internationally operable standard. The implementation of chip and PIN in the UK is part of a global programme to tackle increasing levels of plastic card fraud.

Other countries around the world are now at various stages of rolling out the system pioneered in the UK. The rollout has seen the reissuing of more than 140 million payment cards, the upgrading of more than 780,000 retail tills and a change in point-of- sale shopping practices for 42 million cardholders and three million shop staff.

Valentine’s Day 2006 marked the completion of the final phase of the rollout. Chip and PIN cardholders now need to know the PINs on their cards to be sure of being able to use those cards in shops up and down the country. If they do not know their PIN, the card may be declined. If this change had not been implemented, there would still be an opportunity for a fraudster to use a chip and PIN card in a shop – before it was reported stolen by the genuine cardholder – by claiming not to know the PIN. With this scenario removed, cards are less likely to be used fraudulently in a face-to-face retail environment. Figures released recently show that chip and PIN is doing what it was introduced to do – tackle card fraud.

In the first six months of 2004, counterfeit and lost and stolen card fraud losses amounted to £126.6m. During the first six months of 2005, these losses had fallen to £89.9m, a fall of 29 per cent. There is only one type of plastic card fraud that is still increasing. Card-not-present (CNP) fraud – transactions that take place over the telephone or internet or by mail order – increased by 29 per cent to £90.6m from January to June 2005, compared with £70.2m during the first six months of 2004. This is the next big challenge for the industry.

Chip & Pin Online

A number of initiatives are already in place to tackle this type of fraud, including address verification and card security code checking systems. Significant steps have also been taken to make internet shopping even safer through the introduction of Verified by Visa and MasterCard SecureCode – e-commerce solutions that protect cards from fraud when they are used online. Cardholders who sign up to the system can authenticate themselves when shopping online at participating merchants through the use of a private password or code, making their cards much less likely to be used fraudulently online. Online merchants that sign up can expect to experience a significant reduction in their shop’s exposure to fraud and a similar reduction in the number of disputed transactions.

The next stage in making CNP payments even safer is to use the proven security benefits of chip and PIN. The best way to do this is through a token-based authentication system. A token-based system uses something you have (the token, or your card) and something you know (a password or PIN) to enable you to create a dynamic passcode for use on a one-off occasion. In a token-based system a dynamic password is generated that changes each time a new transaction is made. The system can also work using a card reader, into which a chip and PIN card is inserted. The user then enters their PIN and the unique password or code is generated, which the customer then enters when prompted. Initially, the industry wants its online banking customers to use the devices with their chip and PIN cards to secure transactions when banking online, but is eyeing the possibility of eventually using the system to authenticate internet and telephone-based transactions.

The industry is looking to develop a UK standard to ensure that the card readers are interoperable. This would ensure that any UK chip and PIN card could be used in any reader, eliminating the need for people with three different credit cards to have three different readers. Individual banks will be deploying the new technology over the next 12 to 18 months.

Internet & Telephone Payments

There was another major plus for retail banking customers in the UK recently when the banking industry announced plans to provide an improved internet and telephone payments system. Internet and telephone banking offers customers an alternative way of banking, but it also has it own issues, such as the time it takes for payments to be processed. At the moment, internet and phone payments made from one bank to another go through the automated clearing system, often referred to as BACS. After the payer’s bank receives an instruction by telephone or internet banking, it will submit the instruction to the clearing house on the first working day the payer’s account is debited. The payment is processed and on day two reaches the destination bank, which updates its accounts and makes funds available in the destination customer’s account on day three.

In May 2005, APACS, on behalf of the banking industry, made a pledge to the Office of Fair Trading’s Task Force to speed up internet and telephone payments. This new system will enable customers to use the internet or phone to make a payment that will reach the recipient’s bank account within a few hours. Crucially, the service will be available all day, every day, and means that customers will have the flexibility and convenience of moving money between accounts or paying bills on the same day within a few hours and on any day of the week.

Successfully delivering this new system by the end of 2007 is going to be extremely challenging, but we are confident it can be done. This new payment system is designed to cater for the large volume increases projected for the future. It will also enable standing order payments to move more quickly, so that money will move from the payer’s account on the due date and arrive at the beneficiary’s account on the same day.

At this stage of the project, 11 institutions, accounting for over 95 per cent of today’s automated payments, are committed to the new service. Other institutions will be able to join or access the system through agency arrangements with a founding member, just as they do with other payment systems. The OFT’s Payment Systems Task Force has now turned its attention to cheques, and in October 2005 it set up a separate working group to examine issues relating to cheques. This group is expected to report its findings in summer 2006.

The cheque, of course, is declining in usage. Eleven million cheques a day were issued in 1990, but by 2004 these were down to six million a day, a decrease of 45 per cent in just 14 years. By 2014 it is predicted that these volumes will have dropped another 42 per cent to just three-and-a-half million per day. APACS continues to refine and improve its role at the forefront of the UK payments association, and recognizes the ongoing importance of delivering robust, secure and efficient payment systems that are welcomed by financial institutions and their customers throughout the UK. The introduction of chip and PIN and the implementation of a faster telephone and internet payment system are two giant steps towards that goal.

< back to the Future Banking Executive Corner page <