Untangling Internal Scanning: how zone routers impact PCI scanning requirements

Retailers who are evaluating how to maintain PCI compliance are likely to hear the word “scan” from third party compliance providers, or as a part of a letter from your acquiring bank.  The evolution of the POS EPS and move to POS IP connectivity for payment and loyalty has introduced new complexity to PCI scanning requirement. Retailers with newer POS now have an EPS as a part of their system. The EPS sits between the POS and the Front-End Processors and separates the card processing from the POS system creating both the Card Data Environment and Non-Card Data Environment. One result of this configuration is the need for a “Zone Router”. The Zone Router is typically installed behind the Store Router/Firewall/Gateway and Store LAN and in front of the POS/EPS. Retailers with Zone Routers need to consider how this technology impacts their responsibility for Internal Scanning

 PCI DSS v3.0 chapter 11.2 says that you must “Run internal and external network vulnerability scans at least quarterly and after any significant change in the network”. What “significant change” means is open to interpretation by the QSA, but could mean; new system component installations, changes in network topology, firewall rule modifications, product upgrades or almost anything touching the network.

For many Retailers, their expectation is that a single scan will satisfy PCI DSS requirements. For most merchants, however, the requirement is to conduct at least two separate scans: one from the inside (i.e., an “internal scan”) and one from the outside (i.e., an “external scan”). External vulnerability scans look for holes in the store perimeter firewall(s), where malicious outsiders can break in and attack the network. Internal vulnerability scans operate inside the store perimeter firewall to identify real and potential vulnerabilities inside the business network. Retailers with a Zone Router installed must perform three scans; external, and internal scans both within the CDE and Non-CDE.

Internal and External scans are critical components to maintaining PCI and protecting the network and hence, the business from attack by data thieves.  Like loss prevention, internal scanning is a hedge against disgruntled employees who have targeted systems from the inside, or malware, such as viruses or Trojans, that are downloaded onto a networked computer via the Internet or a USB stick. Once the malware is on the internal network, it sets out to identify other systems and services on the internal network—especially services it would not have been able to “see” from the Internet. Internal scans search the internal network for threats to assure the business valuable assets are properly secured.

The challenges of scanning within the CDE for POS systems with Zone Router is new and not all POS systems have defined how to manage this requirement. Retailers seeking managing a new set of scans, particularly for organizations managing centralized scanning engines, will find this requirement adds cost and time to compliance activities. When implementing a Zone Router, Retailers should consider how they will manage all three separate scanning requirements inside of a single actionable approach to their vulnerability scanning.

The EMV illusion: the connection between EMV and mobile payment.

Dai Vernon, “The Professor”, who died in 1992 was a Canadian magician and the greatest sleight of hand figure in the history of the art. He rarely performed, but he invented magic and had an enormous influence on the whole range of “sleight of hand”. And so often, the magic he was doing was to fool other magicians. Such is the case with yesterday’s announcement that the EMV AFD mandate, scheduled for 2017, is moved to 2020. The “sleight of hand”; create a crisis, propose a solution and when the true motivation for the project evaporates, move the requirement far enough into the future that its purpose fades until the need is so obscured as to not be necessary. The Professor would be proud, but for the many retailers, hardware manufactures and professionals betting on EMV at the pump, this is a cruel trick.

A few years back I wrote that EMV, while being presented as an antifraud tool, was really a disguised methodology to bring NFC to the pump. After all, if the goal was simply to eliminate counterfeit card use, swipe and PIN would have essentially eliminated that counterfeit card fraud.  So, why was EMV/NFC so important, if there were cheaper ways to reduce fraud? The answer lies in mobile payment.

During the last five years the world has witnessed the conversion to a mobile digital society. Initially the card associations sought to enable mobile through the use of NFC. This was critical because the Card Brands sought to protect their business model against disruptive models and bake bank issued cards into payment terminals and the AFD.  The ROI on mobile payment is elusive and so the EMV liability shift was created (the sleight of hand) to create the ROI needed to drive NFC to the pump. What went wrong?

Two major issues have pulled the curtain back from the EMV illusion; cost (how) and need (way). There is little to say about the cost of EMV, other than prohibitive. One MOC showed me an estimate where the cost was north of $100M, WOW!

The “why” is more complicated. Over the last two years, cloud based payment models that leverage the POS, rather than NFC at payment terminal are now proving themselves in the market. MasterCard and Visa’s agreement with PayPal, the release of standards and multiple pilots, are an indicator of their belief that cloud based solutions will lead the way in mobile. Cloud based systems do not require communication between the payment terminal  the phone, and therefore many of the arguments about NFC are eliminated.  Further, there are many use cases, like vehicle based payment or drive-troughs where cloud based solutions are more effective than NFC. If cloud-based solutions become wide spread, then NFC is no longer relevant. Further, if you believe, as many do, that millions of consumers will adopt mobile, and mobile payment will be cloud based, then as card based usage at the pump declines, the rational for the investment in EMV evaporates.

 

Right to the “3rd” power”: Mobile Payment the POS and ROI

The arc of loyalty/payment programing, particularly as it relates to mobile, is now mature enough for retailers to set long-term strategic goals. The high level strategy is about consumer engagement. The objective is to create a more intimate consumer shopping experience that is contextual in nature. The requirement being: “Right to the 3rd power”; the right offer, to the right person, at the right time. The tool set for loyalty, payment and the integration of omni-channel marketing in the mobile channel is the POS.

Mobile is the most important next generation service, in many ways it is here today. Consumer adoption of mobile services is exploding. The consumer is willing and ready, even waiting for the retailer to catch up. First to market retailers will be in the lead and have an advantage. Ignore mobile and you risk losing both the Millennials and the X-er’s. Is there any doubt that the next group will only be more mobile? Cards, checks and cash will exist, and will require attention, but having a mobile strategy is the key to future success.

While EMV will drive NFC to the POS, consumer engagement will be driven by merchant rewards. The days when retailers give over control of their customers to banks and associations will end as mobile payment becomes the norm. In this war for the mobile consumer, the POS and cloud-based mobile payment is supreme. The transaction is changing from the legacy model of capture/authorize and settle to a robust IP based dialogue. This dialogue is between the consumer and the POS and is about the relationship between the retailer and the consumer. Unlike today where the transaction begins when the item, coupon or loyalty card is scanned, tomorrow’s consumer will begin the engagement long before they arrive at the location. Mobile app based solutions will leverage Geo Fencing, Wireless, and BLE to engage the consumers according to their preference. The IT environment required to deliver these services must be tightly coupled to the POS at the Transaction Services Layer (TSL). This important change in the transaction flow means that payment, rather than being outside of the TSL, is now a part of the TSL. This change means that the entire legacy payments network may be disintermediated from the mobile transaction. We see this with companies like National Payment Card Association and believe MCX shares this goal.

Retailers are understandably concerned about ROI. ROI is a result of more profitable shopping. ROI is more than a function of “frequency and shopping basket”, it is about shaping the consumers purchasing decisions. People are asking about ROI and Mobile and reluctant to allow legacy payment fees into the branded app. To the extent that consumers react through the use of offers, coupons, push notifications, points etc in the mobile channel, payment is required to close the transaction within the same user experience. The notion that the mobile consumer will be interactive with the mobile experience and then be asked to use a card for payment does not make sense. Using a card in the mobile channel would destroy the user experience and make it impossible to measure conversion.

Certainly, there are many issues impacting retailers and the POS environment. The key questions is: which IT solution makes the most sense and how does it set the retailer on the road towards a larger goal of implementing a successful consumer acquisition and retention program that is “Right to the 3rd Power”?

Surcharging for credit versus discounts for cash; why it makes a difference and how the consumer will react.

In the struggle between the Credit Card Associations and Retailers this week’s court decision reminds me of the old western film when two guys are fighting and the guy with the rifle runs out of ammo as the other guy’s gun is a few yards away. There is that brief moment when they both realize that the game has changed and now the race to the finale is upon them.  This week MasterCard Inc. and Visa Inc. along with some large banks settled what had become known as the Brooklyn case, setting the stage for retailers to pick up the gun and shoot first.

 The weapon that the Brooklyn decision has given the retailer is the ability to surcharge the consumer for the use of a credit card.  Surcharging is a tremendously powerful tool that has the ability to dramatically shift consumer behavior. Surcharging is fundamentally different than Discounts; understanding why, is the key for retailers wishing to leverage this decision. How powerful is surcharging?  Alphawise (Morgan Stanley Research) reports that “43% of consumers would be “very-likely” to switch from credit/charge cards to debit, cash or check if asked to pay a 1-2% surcharge by a merchant”. Further, “on average, those who said they would be “very likely” to stop using a credit card would shift about 67% of their credit purchases to other forms of payments”.

Retailers have some experience with offering discounts for cash or alternative payment discounts.  In the Convenience Store Industry, the per gallon discount for cash or merchant issued debit has been moderately successful. Some merchants like Savannah’s Parker Stores, are offering up to 10 cents off per gallon for consumers using their PumpPal card. These programs are reported to have captured between 5% and 25% of their consumer’s transactions.  But if Alphawise is correct, and Parker posts a price of $3.50 with PumpPal, and then ROLLS-UP the price of gas by 10 cents per gallon for the use of credit, then according to Alphawise’s survey results,  upwards of 50% of consumers appear ready to walk away from credit cards

The reason Surcharging is more powerful than Discounts is because of “Network Effects”. Network Effects are an economic term that describes the attraction of two groups of end-users across a “platform”. The reason the card associations have never allowed surcharging is because the economic principles driving a platform (two-sided market) state that only one side of the platform can be weighted with fees to the end-user.  An example of network effects is the Adobe PDF Reader. Almost all of us have the PDF reader on our computers, and it is free. The PDF writer on the other hand is expensive. The reason the writer is expensive is because so many people have the reader. If Adobe had charged for the reader it’s likely no one would have purchased it and as a result, the writer would be valueless. The same is true for credit cards, show the consumer the real cost of using their credit card and they are likely to find another way to pay.

The question is; will the Retailers react? Like our gun fighters, there is risk going for your gun.  Mike Schumann, owner of Traditions Classic Home Furnishing in Minneapolis was quoted in the WSJ saying that he is “hoping that surcharging will become commonplace, but that small firms will not lead the charge” adding that he might charge 2.5% to 3% if his competitors adopt the practice. During a call with a national home furnishings chain, the CIO wondered aloud how consumers would react to seeing an $80.00 upcharge for a major purchase. It’s a good question. But what does seem clear, is that in areas of every day spend, like gasoline and groceries, retailers have a new tool. We’ll have to see if they choose to use it.

 

New Bank fees set the stage for Merchant Issued Debit and Rewards.

The stage is set for an epic battle between the merchant community and the financial industry to win the consumers method of payment (MOP).  This week, BoA joined the list of financial institutions announcing either fees, or cut backs in consumer rewards programs, for debit card use .  Senator Dick Durbin sounded surprised when he said of BoA’s actions; “It’s overt, unfair” adding that “Banks that try to make up their excess profits off the backs of their customers will finally learn how a competitive market works”. Many in the industry had long predicted that this would be the immediate result of the regulation (see my June 13, 2011 Blog).  Regardless of the merits of the regulation, or the banks reaction to it, one immediate result is that merchants have the opportunity to steer consumers to a lower cost form of payment (debit): the question; will they be able to leverage this opportunity, or will the payments industry adjust their payments offerings steering consumers to unregulated forms of payment with higher fees i.e. credit, pre-paid cards, etc.

The pivotal decision for merchants is how to recapitalize the anticipated saving from swipe reform and use that money as an incentive for consumers to choose a lower cost form of payment.  Many merchants, particularly in the petroleum and grocery industry are already actively competing for method of payment by offering ACH decoupled debit card programs (merchant issued debit) or cash discounts. For these merchants, and vendors offering alternative payments  like PayPal or National Payment Card Association, the Durbin Amendment is living up to expectations providing them with a strong tailwind to the merchant and consumer.

Merchants are understandably cautious as they approach payment.  While technology, investment and ramp time look like the heavy lift, the real challenge is to understand the economics.  Traditionally merchants have relied on the bank and card associations to deliver payments.  During the lead up to regulation one argument was that; “there was no competition for payment”. Merchants’ successfully argued this point, irrespective of the intense competition between banks for consumers. What was missing from the debate is that the reason consumers use one form of payment over another is often rewards. These rewards had been paid by the issuers of the card using interchange fees (as much as 50%), and now with regulation, that funding source has disappeared.  Therefore merchants can provide consumers with the same incentive to use a low cost form of payment by offering merchant issued rewards.

Finally, there is a saying “He who enrolls; controls”. Issuance or enrollment is a critical question for merchants choosing to compete for MOP using rewards. Assuming that the merchant chooses to offer rewards for a specific MOP, which MOP should it be, cash, PayPal, Google, or perhaps a merchant issued debit card.  The smartest strategy might be a flexible approach to payment where rewards are based on the costs associated with the method of payment, regardless of whether the rewards are paid for by the merchant, or a 3^rd party.

Durbin’s Catch -22, Merchant Issued Rewards.

Merchants have won a battle, but the question is: can they leverage the advantage and win the war for the consumer’s method of payment?

The phrase “Catch-22” means “a no-win situation” or “a double bind” of any type. In the book, “Catch-22”, Joseph Heller describes the circular logic that confronts an airman trying to avoid combat missions by saying that his claim of insanity is the proof of his sanity. With the passage of Durbin, retailers are faced with the same circular logic. The Catch 22 of Durbin is that consumers must choose debit if retailers are to save on interchange fees, and consumers will only choose debit if offered rewards or to avoid bank fees. Today consumers choose debit in large degree to earn signature based debit reward or because PIN debit does not have bank fees as opposed to credit cards where there are annual fees and interest.  Durbin will change that paradigm as banks make up lost revenue by eliminating signature debit and adding fees to, or eliminating, pin debit cards. If those changes occur then retailers will need to fund consumer debit rewards to promote debit payment. Because merchant issued debit rewards erode Durbin’s potential cost savings, the potential is that total debit transactional fee may be higher than those during the pre-Durbin era…Catch-22.

Durbin’s challenge to Retailer’s is how to influence the consumer’s method of payment. Just because consumers are choosing Debit today, does not mean they will be choosing Debit tomorrow. The reasons why consumers choose one form of payment over another (Debit, either signature or PIN, cash, credit, check, prepaid etc.) are complex, but “Rewards” plays a large role in the process. In fact, nearly 50% of all interchange dollars are used to fund reward programs. A quick review of Bank advertising for Debit will show that Debit Rewards is tied to Signature Debit, not PIN Debit; “rewards are ” Pen, not PIN”.  Rewards for Signature Debit, plus “No Fee” PIN debit has created significant consumer demand for debit products. The banks loss of signature debit interchange fees means that these reward programs will disappear and consumers will begin paying fees for PIN debit. The result is that Durbin will change both the Debit and Payment Card market, not just the fees.

Look for these results:

1. Look for more pressure on retailers to install Pin Pads. Signature debit will go away as Financial Institutions will not longer offer signature debit. The whole point of signature debit was capture credit card like interchange fees. Debit rewards programs are funded by credit card like interchange fees and at Durbins mandated +/- 12 cents there is no “rabbit in that hole”. The reason retailer’s implemented PIN pads (3dez) were to move consumers from Pen to PIN. If Merchants are to win from Durbin, PIN Pads will play a large role in that success; otherwise there will be no debit at retail. Durbins “$10 Billion” exemption is a wild card. If smaller institutions introduce aggressive signature debit programs at the expense of larger institutions then Durbin will prove to have cost retailers more than they will save.

2. Financial Institutions will seek ways to replace lost revenue. The most immediate impact is likely to be fees on both dda accounts and perhaps the use of debit cards either as a transaction fee or monthly fee. Banks will discriminate against Debit making it less attractive. One of my associates added “Issuer’s already have plans to discontinue issuing debit cards and returning to ATM only cards.” He adds “other issuer’s are going to place a transactional cap on debit cards instead of taking them away.  They will only allow a transaction for $50.  If the transaction is $51 – then, another $1 transaction will have to run.”  Say good-bye to friendly debit transactions.

3. Watch for growth in closed loop debit card, particularly ACH Decouple Debit.

In the short term, Merchants will realize a windfall as consumers who use Debit maintain that method or payment. Debit usage will drop off unless Merchants introduce “Merchant Issued Rewards”. Merchant Issued Rewards are another name for loyalty. I can offer more on that if requested. The question retailers need to answer is: If you must offer rewards to promote debit, why not promote your own debit card? Durbin will increase the importance of loyalty rewards as merchants compete with FI’s for the consumer’s method of payment (i.e. PIN Debit).

4. Watch for more aggressive Credit Card and Pre-Paid card offerings with lower credit card fees, easier credit and more aggressive rewards. Pre-Paid is apt to be the next place the FI’s push for consumer adoption and fees. As the economy strengthens, and consumer debt drops the structural issues negatively impacting credit will lesson. Financial institutions can impact the consumer’s attitude towards credit by being more consumer friendly. The loss of signature debit will hasten this activity.

5. One “Wild Card” is the DOJ lawsuit on credit card interchange fees. There has not been a lot of press on this, but there will be soon.

 

 

Competitive opportunity in a post Durbin world: richer debit rewards as the unintended consequence of the $10 billion exclusion.

Dozens of articles have been written about the impact of the Durbin Amendment on the payment card industry, with nary a positive comment in the mix. The focus has been on the punitive impact that the legislation will have on both financial institutions and consumers. The consensus has been that banks will lose significant revenue and that consumers will see more bank fees as costs are shifted to make up for lost interchange revenue. This article takes a different approach and looks at the new market opportunity hidden in the bill, the opportunity for smaller financial institutions to launch aggressive debit reward programs fueled by higher interchange fees.

Under Durbin’s “reasonable debit fee requirement,” there is an exemption for banks and credit unions with assets under $10 billion (this includes 99% of all banks and credit unions). This means that Visa and MasterCard can continue to set the same debit interchange rates that they do today for small banks and credit unions.  Those institutions would not lose any interchange revenue that they currently receive; in fact they could receive even higher rates. Many experts writing on Durbin have concluded that this exception will be meaningless because the networks will be unable to accommodate multiple fee structures and as a result, while exempt, interchange fess on those financial institutions will suffer along with their larger brethren.

The argument is that the required costs and effort, such as network IT changes to accommodate multiple interchange fees, make this outcome unlikely. The recognition that business pressure from small banks and credit unions on the networks, Congress or the Fed could leave the networks with little choice but to develop a two tiered fee structure may alter this conclusion. A few weeks back, TCF, an issuer whose business is above the $10 billion exemption, filed a lawsuit stating, “the thousands of banks exempted from the amendment will be free to continue to charge retailers the current debit-card interchange rate and recover all their cost plus a profit. This will result in an irrational competitive disadvantage for banks like TCF that are subject to the new regulations.” It appears from TCF statements that the idea of 7000 smaller financial institutions issuing a new class of richer debit reward cards seems not only plausible, but probable, and a real threat to their business. The focus on the challenges associated with creating a network pricing schema that allows for multiple interchange rates, rather than discussing the market dynamics, is missing the business opportunity.

The reason this will happen is that the payment card industry is a two-sided market. Durbin treats the payment industry like a utility, but this analysis is mistaken. Durbin and its proponents have argued that the payment card industry lacked competition. This falsity, propelled by an active merchant lobby, found resonance in Congress. In reality, the payment card business is a highly competitive marketplace. It just happens that the competition is between financial institutions fighting for a larger share of the consumer market. The result of this competition is higher fees to those wishing access to the market.  Durbin seeks to upset this market, ignoring the two-sided market economics driving consumer demand.

Consumers will move their purchasing to whatever product provides the most incentives. Merchants will accept the business from any large group of consumers, and Durbin does not allow merchants to discriminate by issuer on a network. What this means is that smaller financial institutions will introduce richer debit rewards programs attracting larger shares of consumers who will then shop at retail locations using those cards. Retailers will not turn customers away because payment method would be become a factor in the consumers choice of retailers, something no marketing department will allow.  This is the result of network effects, and they are the unavoidable economic reality driving the industry. The resulting competitive dynamic is in play: issuers will want to try to drive up fees on the merchant side of the market, delivering greater rewards on the consumer side. Consumers will look for low-fee banking services and richer rewards that are supported by these programs. As a result, millions of consumers will gravitate from the 90 or so issuers affected by Durbin to the 7000 who are excluded. This looks like opportunity.

The real question is how long it will take the networks to code the system to handle multiple prices for issuers. I’d be surprised if the work was not already well underway and available not long after the Fed sets its rates. Durbin will have closed the door on the top 90 issuers, essentially putting them at a competitive disadvantage. But in closing that door, the way has been cleared the remaining 7000 financial institutions to develop their debit rewards business. In many ways Durbin did for the network what they could not do themselves; i.e Durbin eliminated the power of the major issuers and opened the market to the smaller financial institutions.

The TCF lawsuit has been both ballyhooed and scoffed at.  No matter the outcome in court, the case will have an impact on the industry. If Durbin passes all of its legal challenges, the irony may be that the consumer will benefit as a result of richer rewards programs from smaller issuers, and merchants will see card acceptance costs rise taking no comfort knowing that they won a battle but lost the war.

Incentives or Discounts; increased profit or eroded margin? Are you using buckshot, or firing a rifle?

When it comes to loyalty programs and promotional strategy there are two schools of thought in retail. On one hand, there are those who believe that everyday low pricing is the surest way to gain consumers trust and their business. These businesses believe that loyalty programs are just about giving bigger discounts to your best customers. Certainly one very large retailer with “every day low pricing” has reached the pinnacle and it is hard to argue with their success. But, with the giant sitting on top of the low price heap, what can the rest of the retailer community do to gain market share? Certainly you can not compete on price and stay in business very long. Nevertheless, many retailers cling to the monthly coupon flyer or web site promotion offering today’s new deal; the Buckshot approach.

The second school of thought has a different perspective on pricing and strategy. These retailers believe that consumer’s make purchasing decisions for a complex set of reasons and that their behavior can be motivated by incentive. In this model the customer’s loyalty is critical to business success. The concept is to track, measure, and then provide specific incentives to individuals based on their demonstrated purchasing behavior. This science is the most effective use of marketing budgets and is focused on increasing business with each current customer. This is the rifle shot, one bullet for each customer.

At the end of the day it’s all about profit. Profit is the difference between success and failure.  When it comes time to pay the bills, or dividends, the only number that matters is the “bottom line”, you either earn a profit or you go out of business, “no margin, no mission”. Regardless of strategy, every program, and every effort must have an ROI. The objective is to make money; buy low, and sell high. It’s hard to make up a loss on volume!  Successful retailers negotiate for the best price, terms & conditions and then set prices and launch promotions that will motivate more profitable customer purchasing thus, maximizing profit. Earning a profit is the battle you fight with yourself as you pick the right price point to execute your sales strategy.  It takes cunning and courage to set solid price points, avoiding the traps of promotional discounts that erode margin simply to increase “top line” performance. Does your sales strategy drive more profitable sales, or is your strategy to be the low priced retailer turning over inventory for increased sales?

In every contest there is a moment when the game is decided. A touch-down or goal is scored, a home run hit, or a competitor’s doors shuttered. Retail is a lot like sports. Taking the lead and then winning the contest is about momentum and emotion. Employees and customers must be engaged, excited and motivated to participate. Success is defined as both top-line and bottom-line growth. Company strategy needs to set realistic goals designed to achieve long term success. Retailers use incentives to motivate employees and engage customers.  Incentives without loyalty programs are simply discounts.  Discounts erode margin. Loyalty programs increases both top line growth and increased profits. 

(http://www.linkedin.com/in/peterguidi)