Secure Online Transactions And Payments

Much like in other areas of life, spring is a period of awakening in the card industry as well, which means there are many innovations on the horizon. The evidence of market activity being more intense than ever can be found in new online sales features, legal regulations and the use of card payments in the branches of trade sector where they have rarely been used before.

Mobile phone cases, USB flash drives and other colourful gadgets piled up in our drawers...only because it is so easy to buy them. We click on a product, select the payment method, log into a well-known online payment service and voilà! In a couple of days a completely new colourful item will arrive from China. Have you ever wondered how many such items would be gathering dust in our drawers, if the payment process was considerably more complex? According to regular research in the field the answer to this question is: very few.

One of the world's most prominent internet portals for payment industry, pymnts.com, argues that, according to the latest information available, the major problem for eCommerce sites today is the check-out abandonment at the final step of the purchasing process.

In essence, the results of the research carried out by the abovementioned portal have indicated that 40 per cent of all purchases are lost precisely in this step. The calculations have shown that the estimated value of all shopping carts abandoned at the final step of the purchase in 2016, on the global level, is the dizzy $158 bn! That means that the amount several times bigger than the state budget of Croatia (and many other countries as well) is converted into the revenues elsewhere, but not in the balance sheet of an eCommerce business.

There are a number of reasons why this happens, but the primary reason is the complexity of the checkout process, i.e. the last step in completing an online transaction. No matter if a customer has given up the purchase due to unforeseen costs (such as the cost of delivery), unsupported payment types or a complex payment process (which is a typical case), online shops would have retained a large part of the abovementioned amount, had the last step in the purchasing process been user-friendlier.

Precisely for that reason, eCommerce businesses are now focused on the simplicity of the purchasing process, and many of them are tackling this problem by using a solution which enables saving bank card data in a secure environment, maintained by certified providers of such services.

In addition to a simplified payment process, another benefit and online shop gains by using such a solution is the elimination of secure certificate costs it would incur, if the customers' card data was stored within the shop's own environment. The stored data is used in every subsequent transaction, without the need for the user to enter all card data again. Simply by clicking and possibly entering their card verification code (the so-called CVC number) the user completes the purchasing process in a fast and simple way. This type of online payment, known as „one-click payment“ or „FastPayment“, has been introduced by the biggest eCommerce businesses in the world, such as Amazon.

As the Croatian market is quite responsive to the trends in this segment, later this year a number of Croatian banks which are also providers of the eCommerce service for online businesses are expected to start offering the abovementioned simple payment functionality. There are multiple benefits of this service for an online business: sales volume increases, and the repeat customer rate soars, owing to the fact that purchasing process is way simpler when card data is stored and payments can be made with a single click.

However, regardless of the need for simplicity, payment security should never be at stake.

Therefore, this payment type is made exclusively through the system that enables the maximum security of card data, i.e. the secure environment of a certified service provider, with user authentication by means of using a well-known card payment authentication method, 3D secure.

During the first transaction or while storing their card in a virtual safe (popularly known as „wallet“) the customer enters an additional code, besides the usual card data. This code is usually generated by the token otherwise used for internet banking services or, alternatively, it can be delivered to the customer via text message.

In recent years this additional authentication method has become standard practice for secure online purchases. As such, it has been fostered and supported by credit card companies, while in the years to come the emerging EU regulations on card payments will make it a compulsory method of protection for all participants in online sales, in the whole EU area.

This regulation is based on the widely known PSD2 (Payment Service Directive), a set of guidelines issued by regulatory authorities of the European Commission with the purpose of regulating a number of areas in the finance sector, in particular those related to payments.

The basic premise of the directive is to facilitate innovativeness in the finance sector, inspire healthy competition and, finally, raise security levels for the end-users.

Online businesses have had an opportunity to experience certain effects of this regulation late last year through new card payment fees (the so-called MIF) and the transparency with which they were displayed by the acquirers (banks and credit card companies).

Within the context of online sales, the impact of the directive on online shops has been reflected in the introduction of the compulsory strong authentication of the payment card owner, the so-called SCA (Strong customer authentication).

What is it all about?

The key security issue in the online environment is that it is difficult to prove that the person in front of the screen trying to effect a card transaction is also the owner of the card used for payment in this transaction. In order to reassure all sales chain participants (buyer/card owner, online shop and the bank) that there is no criminal activity taking place, it is necessary to prove the identity of the card owner. And this is precisely what the abovementioned mechanisms do: combine multi-level security checks. To comply with the SCA security standards, authentication needs to satisfy at least 2 of 3 criteria: verify something the user has (e.g. a token-generated code), something the user knows (e.g. the PIN number entered into the token device for the purpose of generating a security code) and something the user is (e.g. a fingerprint).

In that manner the highest level of security is achieved for the card owner, the online shop, and, finally, for the Bank. After all, the combination of such security checks and the simplicity of payment, achieved by using the saved card data, is a match made in heaven. An ideal compromise between simplicity and security that will significantly reduce the revenue loss caused by shopping cart abandonment.

It is a fact that online sales is growing at a constant rate. According to the latest available data, only last year the aggregate turnover of all online businesses in Croatia amounted to over 3.5 bn HRK. If we apply the correlation rule of the global online revenue loss due to checkout abandonment amounting to 40% of all purchases, we can conclude that 2.3 bn HRK, that could have been earned, are permanently lost.  The figure that no one could regard with indifference.

The offer is better than ever too. The evidence of that can be found in the recent strategic decision of the Croatian biggest brick and mortar retailer to embark on a major new online sales project, whose ultimate objective is to become as influential in the region, as Amazon is worldwide.

It is more than likely that simplicity and security of payments will be the backbone of this company's business and other businesses on this expanding market as well.

Nevertheless, card payments made without supervision by a physically present sales person are not reserved only for online sales. Today's lifestyle dictates the availability of goods and services 24/7 in the brick-and-mortar world as well, which has made a wider product range available through various self-service devices. There are devices that are used to sell literally anything: from drinks and food to advanced postal services or public transport tickets.

Although until recently the „cash is the king“ rule applied broadly to such businesses, there is a change coming about.

The fact that an average Croatian citizen has more than two payment cards, mobile payments are expanding and the use of contactless cards is a standard practice nowadays cannot be disputed. Lost sales opportunities due to unsupported payment methods, such as card payments, is a mistake that few retailers can afford to make.

The new star on the scene is the unattended POS terminal, a special device category, adapted to self-service environments.

Card payments made through such a device are as simple and safe as transactions completed via standard EFTPOS terminals, with the major difference being the self-service feature. This is precisely why simple payment process is crucial in this case also, because in our market standard POS payment process consists of several simple steps: the buyer gives his or her card to the sales person, the sales person then takes care of all necessary steps, while the buyer only enters the PIN number or signs the slip.

In the case of unattended terminals, the device itself is the „sales person“, and therefore it is necessary to guide the customer through the procedure, in order to keep the shopping experience simple and encourage confidence and the feeling of security.

In terms of the card payment potential, an impressive number of self-service devices in our market - over 27,000, is a factor that should not be disregarded. If we take into consideration the fact that very few of them are equipped with payment terminals, it is more than evident that this segment will see an exceptional growth in the following period. Both the customers and the banks are ready for this change, the suppliers of traditional cash acceptance mechanisms are looking for the ways to switch to payment terminals, while credit card companies are paying meticulous attention to the situation, and appear to be highly optimistic about this trend in our market.

The introduction of card payment terminals into the segment of self-service devices brings an extremely important advantage, not directly related to payments. Since all payment terminals require Internet access for their communication with the card authorisation server (the Bank), and neither Internet access nor any other type of communication have been enabled on self-service devices in Croatia yet, this innovation could bring new benefits to retailers, as their vending and ticketing machines become part of the online world.

No matter whether they choose to introduce a fixed-line network or use the GPRS communication at their terminals, retailers are provided with an opportunity to gather valuable data from their unattended terminals by means of an automated communications process called telemetry.

This enables a detailed real-time insight into the stock levels of each vending machine, the revenue earned, device status and many other types of data about such devices that are nowadays still collected manually in long time intervals.

The fact that all this data becomes available in real time offers multiple benefits to retailers. Device downtime due to malfunction or stock shortage is dramatically decreased, thanks to the immediate availability of the necessary information, and, most importantly, the retailer saves money and increases the revenues. How?

Savings come from a high level of operational process optimisation, which implies targeted servicing of the self-service network and minimising the possibility of devices being in idle state. Revenue growth results from both the improved turnover, boosted through card payment acceptance, and the minimisation of device inactivity time (i.e. the time needed for an on-site intervention during which all sales opportunities are lost).

Having taken into consideration all of the above, introduction of payment terminals into everyday business transactions brings both the savings and revenue growth to retailers. In today's business world such opportunities to save and make money at the same time are quite rare.

Although card transactions seem to be ubiquitous, it is apparent that there is a lot of room for improvement. Security and simplicity are the key concepts, the foundation for the future of card payments, and all industry segments endeavour to achieve the highest levels of both, with as few compromises as possible, for the benefit of the end-user: the customer.

Several Scandinavian countries are very close to making their vision come true:  a „cash-free“ society, i.e. the economy where money no longer exists. Admittedly, our society is light years away from that mind-set, and it is likely that we will never completely abandon paper money, but it is an undeniable fact that we follow the developments in the world market and are able to catch up with the global trends.

For that reason, next time you purchase something online or buy your favourite snack from a vending machine, while paying with your contactless card, feel proud, because you are making your contribution to the future.

Goran Bosankić, Pre Sales Manager, BU Payment, Asseco SEE