Join the Community

22,277

Expert opinions

44,261

Total members

366

New members (last 30 days)

189

New opinions (last 30 days)

28,765

Total comments

Join Sign in

Eliminating CNP from eCommerce - cont

14 October 2013 Be the first to comment

Retired member

Let's for a moment think outside the box and try to forget about using the SE in the mobile phone as a secure storage for the card info ... consumers already have the proper secure elements in their cards ... there is too much politics involved in arguing about who controls the SE in the mobile phone, and that battle will never be won or the acceptable compromise between Issuers and MNOs may never be achieved ... so let's forget about using the NFC enabled mobile phone in so called 'card emulation mode'

My personal view is that since many Android phones on today's market are already NFC enabled, they could be used simply as the personal consumer contactless card readers during e-commerce transactions to interact with the existing contactless chip cards.

Mini paradigm shift in a way, which would ideally open the doors for the 'card present' e-commerce transactions, if the big players like payment schemes and card issuers would be willing to play along and make the effort to certify such solutions.

External

This content is provided by an external author without editing by Finextra. It expresses the views and opinions of the author.

6000

Report

Channels

/payments

Comments: (4)

A Finextra member

14 October 2013

You (almost) described "Cloud POS" - https://www.finextra.com/blogs/fullblog.aspx?blogid=8336

With some tweaks to the flow and comm. channels, that makes perfect sense. How quickly and eagerly the card networks jump on board is another story (now that they are married to the idea of "tokens" that give them perceived control... - in fact, "Cloud POS" gives them a much better and needed role to play in e-comm...)

Report

A Finextra member

14 October 2013

Alex

The 'token concept' you mentioned schemes are now pushing as their favorite in my view is not a replacement for something like this, but is in fact a perfect complement. You would hope that in those organizations (we have all dealt with them on a business and technical side in our business adventures and startups) they would have enough brain power to realize that.

For example at step 13 in the flow which I proposed in my post, the online merchant side would still get 'token' with the final approval containing the EMV TC cryptogram (instead of the real card data) so that in their system they never see nor never store any cardholder credentials.

I took a look at you blog post about 'cloud POS'. It seems to me that great mind think alike ;-)

Report

A Finextra member

14 October 2013

Milos, one of the token architectures I saw was based on providing consumers with dynamic 16-digit tokens BEFORE the transaction. The token would then be used in leu of a card.

With the "Cloud POS" approach, the customer can use any generic identifier (e.g. email) when initiating the transaction, hence no need for tokens at that stage. As you correctly pointed out, a token can indeed be used after the transaction.

The reason the card networks want to use tokens before the transaction is control - to get a grip on "card on file" competition (such as PayPal)... It's not about PCI, fraud, etc... At all!

Report

A Finextra member

14 October 2013

Sure issuing the 'token' at the beginning of the transaction will also work, but I am unsure if it would maybe require changes to the current processes and infrastructures.

Report