Take On Payments, a blog sponsored by the Retail Payments Risk Forum of the Federal Reserve Bank of Atlanta, is intended to foster dialogue on emerging risks in retail payment systems and enhance collaborative efforts to improve risk detection and mitigation. We encourage your active participation in Take on Payments and look forward to collaborating with you.

Take On Payments

November 13, 2017

The Future of Wearables

My wife and I took our children to a Florida theme park for their recent fall break. While I would love to spend the next few paragraphs opining on why I think our school calendar is crazy or giving a review of the most phenomenal ride that I have ever experienced, it doesn't really fit the mission or purpose of Take On Payments. Fortunately, the trip did provide some fodder and thought for a blog post, thanks to a much-discussed and written-about wearable NFC—or near-field-communication—device that the theme park offers.

These bands were introduced in 2013 to create an awesome customer experience. This experience is much bigger than a payment platform and has absolutely nothing to do with a rewards program around which so many mobile wallet and payment applications are being developed. The band's functionality certainly includes payments, but the device also replaces room keys, park entry cards, and ride-specific tickets known as fast passes. As an additional feature, it is waterproof, which proves handy for a trip to the water park. I was able to spend the week without ever having anything in my pockets (yes, I even left my phone in the room). My wife commented how fantastic it would be to take the NFC band experience outside of the park because it was just so easy and convenient.

Ease and convenience–isn't that what a lot of us are after? If you have to give me something to get me to open an application and tap my phone in place of a payment card, is that really providing ease and convenience? I am now 100 percent convinced that rewards programs aren't going to drive mobile commerce to any significant degree. Experiences that provide ease and convenience will drive mobile commerce. Hello, mobile order-ahead. Hello, grocery delivery. And hello, wearable of the future.

It isn't hard to imagine a wearable device, like an open-loop band, transforming our lives. After my theme park experience, I long for the day when a wearable will be the key to my vehicle—which I won't have to drive, either—and to my house, my communication device, and my payment device (or wallet). Of course, we'll have to consider the security issues. Even the bands incorporate PINs and fingerprint biometrics in some cases to ensure that the legitimate customer is the one wearing the band.

Is this day really so far-fetched? I can already order a pizza through a connected speaker, initiate a call from the driver's seat of my car without touching my phone, or tap my phone to pay for a hamburger. The more I think about these possibilities, I have to ask myself, is it crazy to question whether or not using mobile phones for payments just might become obsolete before long? Or maybe mobile phones will provide that band functionality?

Photo of Douglas King By Douglas A. King, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed



November 13, 2017 in banks and banking , innovation | Permalink | Comments ( 0)

November 6, 2017

My Fingertips, My Data

I am not a user of old-style financial services. While I remember learning how to balance a checkbook, I never had to do it, since I never had checks. Recently, my financial adviser suggested several mobile applications that could help me manage my finances in a way that made sense to me. I researched them, evaluated a few, and decided which one I thought would be the best. I'm always excited to try new apps, hopeful that this one will be the one that will simplify my life.

As I clicked through the process of opening an account with my new financial management app, I entered the name of my financial institution (FI), where I have several accounts: checking, savings, money market, and line of credit. The app identified my credit union (which has over $5 billion in assets and ranks among the top 25) and entered my online banking credentials—and then I was brought up short. The app was asking for my routing and account number. As I said, I don't own any checks and I don't know how to find this information on my credit union's mobile app. (I do know where to find it using an internet browser.) I stopped creating my account at this point and have yet to finish it up.

I later discovered that if I banked with one of the larger banks, for which custom APIs have been negotiated, I would not have been asked for a routing and account number. I would have simply entered my online login details, and I'd be managing my finances with my fingertips already. I started digging into why my credit union doesn't have full interoperability.

In the United States, banking is a closed system. APIs are built as custom integrations, with each financial institution having to consent for third parties to access customer data. However, many FIs haven't been approached, or integration is bottlenecked at the core processor level. It is bottlenecked because if they deny access to customer data (which some do), the FI has no choice in the matter.

New Consumer Financial Protection Bureau (CFPB) guidance on data sharing and aggregation addresses the accessibility and ownership issue. The upshot of the CFPB's guidance is that consumers own their financial data and FIs should allow sharing of the data with third-party companies. But should doesn't equal will or can.

The CFPB guidance, though not a rule, is in the same vein as the European Union's PSD2 (or Directive on Payments Services II) regulation, whereby FIs must provide access to account information with the consumer's permission. This platform, which represents an open banking approach, standardizes APIs that banks can proactively make available to third parties for plug-and-play development.

While open banking is a regulatory requirement in Europe, market competition is driving North American banks to be very interested in implementing open banking here. An Accenture survey recently found that 60 percent of North American banks already have an open banking strategy, compared to 74 percent of European banks.

It is no surprise that bankers are becoming more comfortable with the shift-in-ownership concept. FIs have been increasingly sharing their customers' data with third parties. Consumer data are what fuel organizations like credit agencies, payment fraud databases, identity and authentication solutions, and anomaly detection services, to name a few. As these ownership theories change, we will also need to see new approaches to security. What are your thoughts about open banking?

Photo of Jessica Washington  By Jessica Washington, AAP, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed



November 6, 2017 in banks and banking , data security , emerging payments , innovation , mobile banking | Permalink | Comments ( 0)

October 30, 2017

Why the Explosion in Household Payments?

In a post last August, I analyzed some of the data from the inaugural release of the entire aggregated data set of estimated noncash payments from the latest Federal Reserve payments study. In this go-round, I will discuss the household payment figures in the report that accompanied the data set. These figures reflect core noncash payment types—including ACH transfers, check, nonprepaid and prepaid debit cards, and credit cards— that consumers in the United States use today.

The two pie charts show the distribution of household noncash payments for 2000, when the payments study began, and for 2015. Over this period, the number of consumer payments increased to 117.5 billion in 2015 from 50.7 billion in 2000. The area of each pie chart reflects the proportional difference in the average monthly household noncash payments for the two periods. In 2000, households made on average 40.3 noncash payments per month, compared to 78.6 monthly payments in 2015, a 95 percent increase.


Besides the near doubling of monthly payments per household, the other striking difference is the distribution of payments by type over time. Most dramatically, checks written decreased 6.4 percent per year over this time while debit cards, with an annual increase of 13.7 percent, were on a tear.

As the report notes, and according to my own speculations, increases in the number of monthly household noncash payments could be attributed to the following factors:

  • Some payments that historically would have been made with cash are now made with mostly noncash forms of payment. Debit cards snagged the greatest share, given their high growth rate and relatively low average ticket amount, which aligns with payments typically made with cash.
  • Storefront merchants and consumers have expanded their acceptance of card payments as a substitute for cash and check.
  • The growth of remote payments such as ecommerce have reduced check and cash usage.
  • Many people have migrated from using cash and check to using payment cards so they can gain points and other benefits from card rewards programs.
  • Online purchases of digital content such as games and music have brought about increases in micropayments.

We might surmise that increases in the number of payments in 2015 are also due to increases in household expenditures since 2000, though this is hard to quantify by number of payments. World Bank data show aggregated U.S. household consumption expenditures of $12.284 trillion and $6.792 trillion (in current dollars) in 2015 and 2000, respectively. Unlike the payments study data, these figures include both cash and noncash payments, and some of the expenditures are derived from imputed income related to high-ticket items such as purchases of homes and automobiles. With these caveats in mind, dividing these figures by the number of households during each of these years shows that the per-household expenditures in current dollars is about 52 percent higher in 2015 than it was in 2000. Not all of this gain came about from more payments—some payments may be higher ticket amounts than in previous periods due to luxury purchases.

What are your views on other factors contributing to the near doubling of monthly household noncash payments since 2000?

Photo of Steven Cordray  By Steven Cordray, payments risk expert in the Retail Payments Risk  Forum at the Atlanta Fed

October 30, 2017 in payments study | Permalink | Comments ( 1)

October 23, 2017

ACH and Consumer-Only Payments: Will the Twain Ever Meet?

For many years, person-to-person (P2P) payment providers have touted the emergence of compelling P2P mobile-based products that exploit some combination of financial institutions (FIs) and fintech providers. Several players have made notable inroads into P2P with certain demographics and use cases, but the overall results in terms of absolute numbers are far from ubiquitous. This post uses hard numbers to explore what progress ACH has made with P2P payments.

During a payments conference earlier this year that showcased findings from the Fed's triennial payments study (here and here), the table below was presented showing the number and value shares of domestic network ACH payments in 2015. The table is complicated because it shows both debit pull and credit push payments by consumer and business counterparties. Despite the complexity, the table distills ACH to its essence by removing details associated with the 14 transaction payment types (known as Standard Entry Class codes) that carry value for domestic payments. Many of these individual codes reflect similar types of payments (for example, three codes are used for converting first presentment checks to ACH). As expected, virtually all payments involve at least one business party to each payment. Consumer-only payments are negligible.


In a typical use case for consumer-only ACH, a consumer transfers funds from one account to another account across financial institutions. As shown in the solid red oval, 0.04 percent of all domestic payments were consumer-to-consumer payments, where the payee initiated a debit to the payer's bank account. For consumer credit push payments, the figure is 0.3 percent. The combined figure rounds to 0.3 percent. On the value side for consumer-only payments (in the dashed red oval), debit pulls, credit pushes, and the combined figure were 0.02 percent, 0.2 percent, and 0.2 percent, respectively. These types of payments typically reflect P2P payments1, when one consumer pushes funds to another consumer.

The next table shows the figures that prevailed in 2012. Given the modest share by both number and value across both years, it is apparent—and interesting—that ACH has made little progress in garnering consumer-only payments. Although ACH is ubiquitous on the receipt side across all financial institutions, it is not so for consumers, given the lack of widely promoted and compelling service offerings from FIs and no standardized form factor like there is for card payments. Additionally, many small FIs do not offer ACH origination services.


This lack of adoption is not unique to ACH. Although some of the electronic P2P entrants are experiencing significant growth, it will be some time before they supplant the billions of P2P cash and check payments. P2P players on the FI-centric side include Zelle, which a large consortium of banks owns. Non-FI providers include PayPal and its associated Venmo service. Given the lack of ubiquity with the new offerings, the fallback option for consumer-only payments is cash and checks. As the payments study reports, check use is still declining, though the most recent trend shows that this decline has slowed. ACH or other electronic options still seem a good bet to continue to erode paper options, but perhaps the market is signaling that paper options have ongoing utility and are still preferred if not optimal for some users in some instances.

So what would it take for ACH to gain some traction in the consumer payments space? Perhaps the presence of same-day ACH, in which credits were mandated in September of 2016 and debits followed in September 2017, offers some opportunity for compelling service offerings coupled with a user-friendly way to send an emergency payment to your ne'er-do-well son.

What are your views on the viability of ACH garnering more P2P payments?

Photo of Steven Cordray  By Steven Cordray, payments risk expert in the Retail Payments Risk  Forum at the Atlanta Fed



1 Sometimes account-to-account (A2A) transfers are lumped in with P2P payments.


October 23, 2017 in banks and banking , financial services , mobile banking , mobile payments , P2P , payments study | Permalink | Comments ( 0)

October 16, 2017

No Magic Bullet for Preventing Data Breaches

Much has been written about the Equifax data breach, including a Take On Payments piece several weeks ago. Since the announcement of the breach in early September, my LinkedIn timeline has been filled with articles and messages from sales and development professionals claiming that their technologies and solutions could have prevented the Equifax breach. Unfortunately, the weakest leak isn't a technology problem or issue. It is, and will continue to be, the human element.

Before I hear from the sales and development professionals I just referred to, let me say that I believe that technology does play an important role in mitigating data breaches. For example, statistics show that homes equipped with a security system—"hard targets"—are significantly less likely to be burglarized than homes without them—"soft targets." I suspect the same is true for companies and data breaches in that those who do a better job of securing their data with technology are harder targets than those who do not. However, technology is only one aspect of preventing data breaches—which brings us back to the human element.

We are the weakest link. We architect and program security systems with flaws. We fail to properly update software or install patches on a timely basis. We open suspicious attachments on emails. We sometimes visit dubious websites and click on suspicious ads or links. We divulge too much information over social media. We share sensitive information with people we think we know and who we think are friendly. And we are mistake- and accident-prone. Education does and will continue to help, but humans will continue to make mistakes and be accident-prone, thus data breaches will remain an ongoing problem.

The late, great musician Tom Petty said, "Music is probably the only real magic I have encountered in my life. There's not some trick involved with it. It's pure and it's real." While Petty's remark that music is probably the only real magic is debatable, there is no debating that data breach prevention has no magic bullet. Educating people remains critical, but, as is all too often the case, education also ends up falling short. As a risk expert, I really wish that I had the answer to preventing data breaches. Unfortunately, human actions trump any answers that I might have. Given the grim outlook for data breaches, it is imperative for companies and individuals to have a plan in place to minimize the damage when a data breach occurs.

Photo of Douglas King By Douglas A. King, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed


October 16, 2017 in consumer fraud , cybercrime , data security , identity theft , malware | Permalink | Comments ( 0)

October 2, 2017

A Record-Breaking Season of Hurricanes and Data Breaches

I lived in the panhandle of Florida in 2005, during a record-breaking hurricane season. Four hurricanes that started in the Atlantic—including Katrina—reached Category 5 status that season. That disastrous hurricane season seemed unsurpassable. Yet hurricane Harvey and Irma set new records (both made first landfall in the United States as Category 4 hurricanes).

As Hurricane Irma made its destructive way across the Caribbean, a different kind of disaster was also setting records. On September 7, Equifax announced a data breach potentially affecting most U.S. adults. Could this year also prove to be a record-breaking year for data breaches? According to the Identity Theft Resource Center (ITRC), there are already 976 on the books. Breaches reached a record high of 1,093 in 2016—a substantial hike of 40 percent over the near-record high of 780 reported in 2015.

Truth be told, we can't be sure these data breach "records" are even accurate. Data breach notification laws vary by state in terms of definitions and standard reporting elements. Even the ITRC questions whether there actually are more breaches or the numbers have risen because more states are requiring public release of information on them.

The ITRC Breach Report is a compilation of breaches confirmed by various media sources and notification lists from state governmental agencies. This list is updated daily and published each Tuesday. The ITRC has been tracking breaches since 2005, but only since 2010 has that tracking included the information that has been exposed. Even so, many notifications made available do not include what damages, or types of records, were at stake.

To that point, we don't understand the extent victims will suffer when, for example, card information is stolen along with Social Security numbers. We have yet to see standard data on how fraud trends morph when a certain type of data breach occurs. Lack of correlation could be a risk to consumers.

With data breaches, as with hurricanes, we can respond better if we know what is at stake. Is it time for states to adopt a uniform set of statutes regarding data breach notifications? What do you think?

Photo of Jessica Washington  By Jessica Washington, AAP, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed


October 2, 2017 in cybercrime , data security , identity theft | Permalink | Comments ( 0)

September 25, 2017

Fed Payments Webinar Series Launching

One of the comments we consistently received when we conducted the Mobile Banking/Payments Survey last fall was the desire for the Atlanta Federal Reserve to provide more educational opportunities on current payment technologies and issues. Not only have small and mid-sized financial institutions expressed this need, but so have consumer advocacy groups and law enforcement agencies. Educational efforts, along with research, on payment risk issues are at the core of the Retail Payments Risk Forum's overall mission.

In response to these requests, the Risk Forum is launching a webinar series called Talk About Payments (TAP). The TAP webinars will supplement this blog, forums and conferences we convene, and other works we publish on the Forum's web pages. The current plan is for the webinars to be presented once a quarter. Financial institutions, retailers, payment processors, law enforcement, academia, and other payment system stakeholders are all welcome to participate in the webinars. Participants can submit questions during the event.

We will have our first webinar—titled "How Safe Are Mobile Payments?"—on Thursday, October 5, from 1 to 2 p.m. (ET). The webinar will cover such topics as mcommerce growth, mobile wallets, tokenization, fraud attack points, and risk mitigation tools and tactics.

Participation in the webinar is complimentary, but you must register in advance. To register, go to the TAP webinar web page. After you complete your registration, you will receive a confirmation email with all the log-in and toll-free call-in information.

We hope you will join us for our first webinar on October 5, and for our future webinars. If there are any particular topics you would like for us to cover in future webinars, please let us know.

Photo of David Lott By David Lott, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed



September 25, 2017 in emerging payments , mobile banking , mobile payments , payments risk | Permalink | Comments ( 0)

September 18, 2017

The Rising Cost of Remittances to Mexico Bucks a Trend

From time to time, I like to look back at previous Risk Forum activities and see what payment topics we've covered and consider whether we should revisit any. In September 2012, the Risk Forum hosted the Symposium on 1073: Exploring the Final Remittance Transfer Rule and Path Forward. Seeing that almost five years have passed since that event, I decided I'd take another, deeper look to better understand some of the effects that Section 1073 of the Dodd-Frank Act has had on remittances since then. I wrote about some of my findings in a paper.

As a result of my deeper look, I found an industry that has been rife with change since the implementation of Section 1073 rules, from both a regulatory and technology perspective. Emerging companies have entered the landscape, new digital products have appeared, and several traditional financial institutions have exited the remittance industry. In the midst of this change, consumers' average cost to send remittances has declined.

Conversely, the cost to send remittances within the largest corridor, United States–Mexico, is rising. The rising cost is not attributable to the direct remittance fee paid to an agent or digital provider but rather to the exchange rate margin, which is the exchange rate markup applied to the consumer's remittance over the interbank exchange rate. As remittances become more digitalized and the role of in-person agents diminishes, I expect the exchange rate margin portion of the total cost of remittance to continue to grow.

Even though the average cost of sending remittances to Mexico is on the rise, I found that consumers have access to a number of low-cost options. The spread between the highest-cost remittance options and the lowest-cost options is significant.


With greater transparency than ever before in the remittance industry, consumers now have the ability to find and use low-cost remittance options across a wide variety of provider types and product options. To read more about the cost and availability of remittances from the United States to Mexico and beyond in a post-1073-rule world, you can find the paper here.

Photo of Douglas King By Douglas A. King, payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed


September 18, 2017 in payments risk , regulations , regulators , remittances , Section 1073 , transmitters | Permalink | Comments ( 0)

September 11, 2017

Identity Theft Part 2: Prevention

In an August 28 post, I wrote about the growing problem of identity theft. Criminals can be a determined lot, and no single tactic is 100 percent perfect. Still, there are a number of measures you can take to reduce your and your family's risk of becoming a victim of identity theft.

These tactics include:

  • Contact the three major credit bureaus and request the creation of a credit file of any minor children and then place a "freeze" on the credit record. The Social Security numbers of minors are a favorite target in identity theft schemes since years go by before children reach majority age and apply for credit. Unfortunately, no federal law addresses a credit freeze capability for minors, so the ability to do so varies with each state, as do any applicable fees.
  • You should consider placing a credit security freeze on your account, too. Such a freeze blocks access to your credit file without your permission. Again, the requirements and fees, as well as the process for removing a freeze (permanently or temporarily) vary with each state.
  • Take advantage of reviewing your credit report once a year at no charge with all of the major credit bureaus to spot any accounts that may have been opened without your knowledge. There are a number of companies offering to help you review your credit report (sometimes for a fee), but you should go to the official site annually to access your reports at no charge.
  • Secure your Social Security number and provide it only to third parties when absolutely necessary. You should not carry it with you in case your wallet or purse is lost or stolen.
  • Promptly review account statements including utility bills to verify transactions to ensure that account information such as contact email address and phone numbers have not been altered.
  • Collect your mail daily and place delivery holds on mail when you will be away from home for three or more days.
  • Destroy any credit offers you do not plan to accept. If you do not wish to receive prescreened credit and insurance offers, you can opt out by calling (888) 567-8688 or visiting optoutprescreen.com.
  • Shred other documents containing personal or financial information to prevent criminals going through your garbage to find such information.

We hope this information will be helpful in stemming the growing tide of identity fraud in this country. If you have other suggestions, please share them.

Photo of David Lott By David Lott, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed


September 11, 2017 in data security , identity theft | Permalink | Comments ( 0)

August 28, 2017

Identity Theft: A Growing Epidemic

I recently attended a conference that explored improvements in identifying and authenticating individuals. Many of the sessions focused on identity theft. While the conference primarily targeted law enforcement, immigration control, and the military, many of the lessons can easily apply to the public sector. A recent industry report validated the conference's focus, noting that in 2016, 15.4 million Americans were victims of identity theft, an increase of 18 percent from the previous year.

Identity theft (also called identity fraud) covers a wide range of crimes in which the criminal obtains and illegally uses another person's personal information in a fraudulent or deceptive manner, typically for economic benefit. In most cases, the criminals get personal information through a data breach, but malware on a computer or mobile phone or email phishing are other sources. Sometimes criminals can get enough personal information from public data—such as property and voter records, as well as social media accounts—to create a false identity and commit a crime.

Social Security numbers appear to be the most valuable information element in creating false identities. For this reason, legislation was passed in 2015 mandating that the Centers for Medicare and Medicaid Services (CMS) remove Social Security numbers from Medicaid cards. CMS recently announced that it will reissue Medicaid cards in April 2018 with a new beneficiary identification scheme.

The criminal actions of identity theft include using account numbers to obtain merchandise that can be monetized, filing fraudulent tax refund returns, and applying for credit to buy cars, lease homes, or even get home equity lines of credit. Outside the financial services arena, identity theft crimes include obtaining medical services, social program benefits, and false identification documents.

The Identity Theft Resource Center is a nonprofit organization established in 1999 to help identity theft victims resolve their cases and to broaden public education and awareness of identity theft, data breaches, cybersecurity, scams and fraud, and privacy issues. The center also tracks the number of data breaches across five industry sectors. As this chart shows, businesses remain the number one target for data breaches, and the number of attacks targeting businesses increased 4.4 percent during the first half of 2017 compared to that same period in 2016.


The increased use of chip cards at merchant terminals has made it more difficult for the criminal element to commit point-of-sale card fraud. Meanwhile, however, overall identity theft fraud is on the rise. So how do we combat this growing threat? We will look at some threat mitigation tactics and tools in a future post.

Photo of David Lott By David Lott, a payments risk expert in the Retail Payments Risk Forum at the Atlanta Fed


August 28, 2017 in authentication , cybercrime , data security , identity theft , malware | Permalink | Comments ( 0)

Google Search

Recent Posts

December 2017

Sun Mon Tue Wed Thu Fri Sat
          1 2
3 4 5 6 7 8 9
10 11 12 13 14 15 16
17 18 19 20 21 22 23
24 25 26 27 28 29 30



Powered by TypePad