The Green Sheet Online Edition
February 08, 2010 • Issue 10:02:01
Is online PIN debit more secure?
As a debate unfolds about the competing merits of PIN verses signature debit, a company called Acculynk has emerged as a pioneer in the use of PIN debit online. Acculynk's product, PaySecure, gives consumers the option of using PIN debit when they make online purchases.
Consumers who enter debit information on a Web site using PaySecure are shown a graphical PIN pad following the entry of their card information, and are given the option to have their transaction processed as PIN debit.
Those who opt against it have their transaction processed as a signature debit and go directly to a purchase confirmation page; those who choose the PIN option enter their PIN by clicking their mouse on the graphical PIN pad.
PaySecure includes a feature that scrambles the PIN pad numbers following each numerical entry, to avoid interception of that information by a keystroke reader. The information is masked on the monitor and encoded within the network over which it's transmitted.
Plane rides and jelly beans
According to Acculynk, seven merchants are processing with PaySecure, which hit the market in March 2009. Among them are AirTran Airways and the Jelly Belly candy company. Two merchant vendors are currently selling the product: Merchant e-Solutions Inc. and Elavon Inc.
According to Kevin Gallagher, General Manager, E-Commerce, for Merchant e-Solutions, trends giving rise to the use of PIN debit include the increased use of debit cards generally, as well as heightened security concerns among both merchants and consumers.
"The shift over the last few years from credit to debit is really driving this to be potentially a gangbuster product," Gallagher said. He added that PIN offerings can "open up a channel for incremental business because there are about 80 million debit holders that are only PIN-enabled for debit."
PaySecure uses the electronic funds transfer (EFT) network operated by providers like Discover Financial Services' Pulse, NYCE Payments Network LLC and Shazam. Interchange rates for online PIN debit transactions on these networks are substantially lower than those for online signature debit.
"What Acculynk does is become the stand-in for every issuer that agrees to [offer online PIN debit], and most issuers would because it's a transaction they don't get today," said Steve Mott, founder and Principal of BetterBuyDesign, a payments industry consulting company.
"The Acculynk rate is significantly less than what the signature debit rate is and what the standard STAR or NYCE rate would be if it goes directly through the issuer," Mott said. "Acculynk is doing a separate deal through the EFT network with the issuers. It's like a separate payment service, the same way PayPal does it. Most of these alternative payment forms usually give you a 20 to 25 basis point reduction from the signature debit rate."
According to Acculynk Chief Executive Officer Ashish Bahl, transaction fees for merchants are 20 to 40 percent lower with PaySecure than with online signature transactions. He added that about half of all PaySecure customers, given the option of signature or PIN debit online, choose PIN debit.
Mott said PIN debit transactions benefit consumers because they tend to clear faster than signature ones. He said most banks clear PIN debit transactions within a day of purchase, whereas signature debit transactions generally take two to three days to clear. Within that extended timeframe, consumers are more likely to overdraw their bank accounts, he said.
Both Gallagher and Mott touted the fraud-fighting benefits of online PIN debit as well, although the capacity of a program like PaySecure to reduce fraud in today's e-commerce environment is questionable.
For one, Gallagher said merchants who adopt the program invariably maintain a non-PIN payment option; given that they do, the PIN feature would seem to do very little to protect against traditional fraudsters, who can simply choose the non-PIN payment option when committing fraud with stolen debit card numbers.
Despite that danger, Gallagher said the benefits to merchants of using multiple payment channels outweigh fraud concerns. "As a merchant, you probably don't want to turn away anyone that wouldn't want to use the PIN debit option," he said. "Lost sales are worse than whatever extra basis points you would have to pay [for a signature or nonauthenticated transaction]."
However, both Gallagher and Mott said even just having the option of PIN debit helps guard against one type of fraud in particular: "friendly fraud," or the practice of making an authorized purchase and then disavowing it.
Consumers who use the PIN option, they said, will have a harder time committing friendly fraud because they've entered a password theoretically known only to the card's real owner, making it much more difficult to credibly disavow a purchase.
"What you're really trying to do with the PIN debit is get the purchaser to own the transaction and not be able to repudiate it," Mott said. "When you're [entering PIN information], unless somebody's holding a gun to your head and making you enter it, you pretty much own the transaction."
Mott added that PaySecure could set the stage for a shift to the exclusive use of PIN debit online.
"With this, somebody like Acculynk and somebody like NYCE or PULSE can go to the issuer and say, 'All the bad guys are using signature debit, and you think you're getting more money on interchange [with signature] ... but after you deduct all the chargebacks and charge-offs from the signature debit, you're really better off doing a PIN transaction," Mott said.
Fraud's hidden costs
Mott noted that "PIN debit is significantly the most popular form of payment for both consumers and merchants," and that issuers that favor signature for its higher interchange aren't always correctly calculating the total costs of additional fraud.
"It's not just the direct losses, but it causes all this noise - the customer service and all this stuff - and now you have a bigger problem on the consumer side," he said.
Notice to readers: These are archived articles. Contact names or information may be out of date. We regret any inconvenience.