28 May 2014
The PIN is mightier than the word
Just over two years ago, what has now become known as the Industry Security Initiative (ISI) was born. In August this initiative will end an era in Australian payments when signatures will no longer work to authorise card transactions.
A key outcome of the ISI (also known as PIN@POS and the PINwise campaign) is the removal of signature as a form of cardholder verification on Australian issued chip cards from four international card schemes used at Australian point of sale terminals from 1 August 2014.
Ten financial institutions came together with Visa and MasterCard (since joined by American Express and Diners Club International) to suggest that an industry-wide approach needed to be taken to reduce the level of fraud on payment cards in Australia. Not that Australian fraud levels were, or are, high in comparison with many other countries around the world but regular articles in the media about data breaches and the fraudulent use of payment cards had heightened consumer sensitivities to the issue.
This trend needed to be addressed in order to maintain the highest levels of trust by consumers in the card payment systems.
The value of fraudulent transactions on scheme debit and credit cards issued in Australia amounts to about $262 million per year. Approximately 25 per cent of this occurs in a “card present” (or face-to-face) environment. It is this portion of the card fraud that will be addressed by PIN@POS. Indeed the switch to “Chip & PIN” in other markets, such as the UK, Canada and many European countries, has led to a significant reduction in card present fraud.
Pace of change map - change in consumer behaviour
The removal of signature from scheme card transactions has been hastened by the rapid and strong adoption by Australian cardholders and merchants of contactless payments. For example, 40 per cent of all face-to-face Visa card transactions in Australia are now made using payWave. Hence signature is caught in a pincer movement, being attacked by contactless on transactions under $100 and by PIN on higher value payments.
Australia has had voluntary PIN on scheme card transactions since June 2008 but, unlike the New Zealand market where voluntary PIN usage rapidly rose to over 90 per cent, adoption of PIN has been slow - with only about 65 per cent of scheme cardholders in Australia using it some five years after introduction. Hence the establishment of the ISI and the PINwise campaign, firstly to encourage a higher level of voluntary PIN usage and then to mandate the removal of signature.
Although the move to PIN@POS may sound straightforward, the path to this point has not all been “plain sailing”. For one thing, there was a need to gain authorisation from the Australian Competition & Consumer Commission (ACCC) for competing payment schemes and competing financial institutions to collaborate and coordinate in relation to the mandatory use of PIN for point of sale transactions; with the aim of being a common and ubiquitous cardholder experience, and a seamless transition to the new PIN@POS environment.
The ACCC authorisation was given on 18 December 2013, leading to a public announcement being made on 22 January 2014 of the August 1st date for PIN.
Secondly, with four international payment schemes and 10 financial institutions involved on the Steering Committee of the ISI, gaining unanimous agreement on technical, timing, communication and other issues was sometimes difficult - given that each organisation has a different set of circumstances in regard to Chip & PIN; be it PIN usage, Chip card issuance, PIN change capability and many other items.
However, all members of the Steering Committee were committed to the mission of the ISI: to increase the security of, and level of trust in, the credit and debit card systems of the international payment schemes in Australia, for the benefit of all market participants (Cardholders, Merchants, Financial Institutions and the Payment Schemes) such that the incidence and cost of fraud reduces. This focus on the ultimate outcome, and particularly the cardholder experience, ensured that consensus was gained and the project progressed with all parties adopting common approaches.
Hopefully August 1st and the removal of signature will pass painlessly and the level of fraud occurring on point of sale card transactions will markedly diminish - all of us who have been beavering away at this for the last two years certainly hope so.
As well as running the PIN@Pos project, Lance Blockley is a managing director of specialist financial services consultants RFi Consulting. Blockley is one of Australia's most experienced payments industry experts having previously run Edgar, Dunn & Co in the Asia Pacific for more than a decade. He has advised payment card issuers, acquirers, third-party transaction processors, technology providers and payment associations in addressing many of the payments industry's major initiatives.
The views and opinions expressed in this communication are those of the author and may not necessarily state or reflect those of ANZ.