Electronic Payments in US

Transcription

1 Electronic Payments in US November 16th, 2014

2 Outline 1 Definitions 2 Current Card Payment Ecosystem 3 EMV & New Regulations in Future 4 Contactless Payments 4 New Security Methods 5 Hardware vs. Software-Based Payment Solutions 6 Evolving Landscape with Apple Pay 2

3 Definitions to Know Term Automated Clearing House (ACH) BLE (Bluetooth Low Energy) CNP (Card Not Present) EMV (Europay MasterCard Visa) Interchange Fee Issuer MCX (Merchant Customer Exchange) MDR (Merchant Discount Rate) Merchant Acquirer (or Processor) MNO (Mobile Network Operator) Definition Network owned by US banks, used to transfer batch payments among members at low/no cost. Wireless network technology developed by Nokia that runs on the same band as Bluetooth (2.4 GHz), but consumes less energy. Designation for credit/debit card purchases made online or at POS for which the physical presence of the card and the cardholder are not corroborated by magnetic stripe, EMV, or other form of physical authentication. Refers to global chip-card standard and governing company; intended to improve upon magnetic stripe technology to enhance card security. Transaction fee paid by merchant bank to card issuing bank. Ultimately borne by the merchant as part of the MDR. Issuing bank; markets and issues credit/debit cards to consumers and earns interchange fees on transactions. Consortium of ~50 merchants with the goal of establishing a proprietary payment method/ wallet for member retailers. All-in cost paid by a merchant to accept credit/debit cards. Entity that prepares a merchant to accept credit/debit cards and facilitates transactions. Mobile telecom companies, e.g. Verizon, Rogers, Vodafone. Source: Mobile Payments White Paper 3

4 More Definitions to Know Term Mobile Wallet Definition Mobile phone app and system that is capable of making electronic payments at the POS. NFC (Near-Field Communications) OTT (Over-the Top) Provider POS (Point-of-Sale) PSP (Payment Service Provider) QR (Quick Response) Coder RFID (Radio-Frequency Identification) Secure Element Softcard (formerly ISIS) Tokenization TSM (Trusted Service Manager) Short-range communication system based on RFID technology that allows secure payment data transfer between devices. Service provider with a product that runs off existing infrastructure/rails rather than one that is introducing a new or proprietary technology standard. Refers to the purchase process and hardware used at a physical retail location. Service provider that enables merchants to accept online credit/debt card and electronic payments. Two-dimensional barcode-like image that can be used to transmit data, including payment and loyalty information. Wireless communication system using electromagnetic/radio waves. Range depends on presence of power source but is typically several meters. Physical element of mobile phone (typically SIM or SD card) that encrypts and authenticates payment details. Mobile Wallet owned by US telecom companies Verizon, AT&T and T-Mobile. System by which a sensitive data element is replaced with a proxy identifier to reduce fraud risk. Party in the NFC ecosystem that serves as a contact point between service providers and NFC mobile phones. Source: Mobile Payments White Paper 4

5 Transaction of Current Card Payment System Source: Morgan Stanley Research 5

6 Current Players Payment Network Operators (Visa, MasterCard) Current electronic card payment schemes rely on the payment network operators to authenticate and authorize transactions. Visa and MasterCard earn network fees, a small piece of every credit or debit transaction that is routed over their respective networks. Issuers (Banks) An issuing bank markets and issues a credit/debit card to a consumer (provide source of funds for cards). Earn interchange on transactions, a fee paid by an acquirer to an issuer in connection with a payment card transaction. Included in the merchant service fee. Merchants Acquirers (First Data, Paymentech) A merchant acquirer facilitates the transaction, helping the merchant to accept credit/debit cards. In some instances, one company can act as both issuer and acquirer (e.g. American Express and Discover Financial Services). US Card Transaction-Based Revenue (2012 $ Billions) $4 $10 $11 $40 Issuers Acquirers Networks Issuer Processors Source: Morgan Stanley Research 6

7 Current Players Continued Issuer Processors (Vantiv, Fiserv) An issuer processor helps facilitate the transaction from credit/ debit card on behalf of the issuer. Some larger issuers have moved their processing operations inhouse however small and medium sized banks still continue to outsource card processing due to cost advantages and improvement of business intelligence and fraud management. POS Vendors (Ingencio, VeriFone) Provide merchants with a comprehensive range of services and solutions for accepting payments. POS vendors have spent on R&D meaning that they now have a full range of terminals for all merchants: EMV, NFC, touchscreen, biometric, self-service, etc. Consumers Consumers are increasingly using their smartphones to search for things to buy things. Consumers are concerned about loss of privacy or security of financial transactions. For consumers to adopt a new form of payment it must be easy to use and as fast as current payment solutions. Consumers are demanding loyalty and reward programs from electronic payments and 2/3 of active mobile wallet users were selecting to receive offers. Consumers trust banks and payment networks for providing a mobile payment solution compared to telecoms or retailers. Merchant (Retailers) The merchant accepts the credit/debit card in payment for the goods. Pay the merchant discount on all card transactions. Large volume merchants like Wal-Mart and grocery chains lose a particularly high portion of gross margin to the merchant discount. Small merchants pay the highest average discount rate and therefore small low-margin merchants are most sensitive to these fees. Merchants would not accept a new payment method if the acceptance cost is higher than current rate. Source: Morgan Stanley Research 7

8 Current Security Problems & Entrance of EMV Security Breach - Target US discount retailer Target announced on December 19, 2013 that it had been the victim of a systems breach in the previous days, which compromised the personal data of some cardholders with Target store accounts. Data breach affected over 110 million consumers and the theft of 40 million credit and debit card details. Consensus that EMV would have mitigated Target breach. Magnetic Stripe vs. EMV When a traditional magnetic card is swiped, the cardholder details contained in the magnetic stripe is transmitted into the terminal, where they are encrypted using Payment Card Industry (PCI) standards. If the terminal has been compromised, card data can be stolen or skimmed. With EMV, chip embedded in the card employs more security features to protect cardholder information than magnetic stripe. EMV has seen an 80% reduction in credit card fraud since introduced. New EMV Regulations from Payment Networks October 2015 Liability will shift to acquirers for domestic and cross-border counterfeit fraud card-present POS transactions if the merchant does not have an EMV-enabled POS device. October 2017 Liability shift takes effect for transactions generated from automated fuel dispensers. This allows more transition time to account for higher equipment/pump costs. The acquiring community, to include acquirers and merchants, will be responsible for the cost of upgrading or replacing their POS devices. Since there is more data sent to the acquirer from an EMVcompliant transaction that a current magnetic stripe transaction, merchants will need to work with their acquirer or processor to accommodate the transaction messaging for EMV- based payment. Has the Target Breach Changed Your EMV Priority? 1% 34% Less Important More Important No Change in Priority 65% Source: Morgan Stanley Research, TSYS, Harland Clarke 8

9 The State of EMV Countdown to 2015 Time Frame for EMV Implementation Main Reason for Migrating to EMV Months 6-12 Months 2% 10% 10% 22% Requested Competitive Advantage 7% 4% 5% 7% Months 29% 38% Fraud Deterrent 38% 44% 18+ Months 22% 43% Shift Liability 33% 34% Not Applicable 7% 17% Not Applicable/Other 11% 17% 0% 10% 20% 30% 40% 50% Type of EMV Program 0% 10% 20% 30% 40% 50% EMV Penetration Rate for Terminals (Except US/China) 74% 58% % 76.70% 94.50% 73.20% 50.50% 5% 21% 21% 13% 8% 1% EMV Only EMV + RFID (NFC) Undecided Not Considering EMV LatAm, Asia/PacificMideast & Canada, Africa Carribean Western Europe Eastern Europe Source: Morgan Stanley Research, Harland Clarke 9

10 Contactless Payments - Near Field Communications Overview Near Field Communication (NFC) is a technology for the wireless connection of devices which links the online and offline worlds. It is based on the development of RFID (Radio Frequency Identification) technology, in which data on a transponder can be read and stored contactlessly. The range for NFC has deliberately been limited to a maximum of between cm so that the user can keep the communication under the best possible control. Supporting infrastructure is not in place to help make the most of NFC (Primarily in US). However 86% of point-of-sale terminals will be NFC enabled in North America by The two types of mobile contactless payment methods: Device Centric The contactless application runs on an Secure Element chip. This chip is embedded in the phone. SIM Centric The contactless application runs on the SIM which acts and the Secure Element of the NFC Front End. Device Centric NFC Approach SIM Centric NFC Approach Source: Samsung, Single Wire Protocol, Deutsche Bank, GSMA 10

11 NFC - Host-Based Card Emulation (HCE) Overview Google has introduced a new platform to support secure NFC-based transactions, through host-card emulation (HCE). The system uses software to emulate EMVCo-type smartcards, and can be used for payments, loyalty programs, card access, transit, and other customer services. The system requires the mobile handset to have an NFC controller and does not offer APIs for directly communicating with a secure element itself. HCE can coexist with secure element in process called AID routing, allowing the NFC controller to determine where to route a request from a reader to communicate with a given NFC application. Ex. When customer chooses a payment app that stores credentials inside the Secure Element, the NFC controller routes the transaction to the secure element. One benefit of HCE is that it does not require a third-party TSM. More exposed to malicious attacks than an applet in the secure element, so extensive security features must be added to mitigate risk such as tokenization, device fingerprinting, geolocation prior to authorization. NFC Emulation Without a Secure Element Coexistence with Secure Element Cards AID Routing Source: Android, Morgan Stanley Research, Smart Card Alliance 11

12 Magnetic Stripe Transmission (MST) Overview MST technology generates changing magnetic fields over a very short period of time. The signal emulates the same magnetic field change as a magnetic stripe card when swiped across the same read head. The reader head converts this fluctuating magnetic field into an equivalent digitized electric signal, recreating the same data stream that was originally written onto the magnetic stripe. Works within a 4 inch distance from the read head, and the magnetic field dissipates rapidly beyond that point, and only exists during a transmission initiated by the user. This effectively transforms 90% of POS terminals into contactless receivers for mobile payments, without any additional POS upgrades. LoopPay is current holder of patent for MST technology. Their solutions require either their dongle or phone case in order to use MST, as MST capabilities are not in any smartphones to date. Data security a concern magnetic stripe reading not as safe as EMV (pin-and-chip). Data exchange of LoopPay will be tokenized for added security. LoopPay Has Recently Received Investment From Visa LoopPay s Phone Case and Dongle That Use MST Source: Loop Pay, USPTO, Business Wire 12

13 Security Problems That EMV Doesn t Address 1. Card Data Security During/After Transaction Process EMV does not address merchant-specific risks such as the interception of card numbers in transmission on the merchant network. Attacks against repositories of card information within the merchant, acquirer, processor, network, or issuer environment not addressed. The PCI Security Standards Council notes: in EMV environments, the PAN is not kept confidential at any point in the transaction. The largest breaches of card information in the US have come from vulnerabilities within the merchant or processor environment that EMV does not address. Many merchants retain payment card data after the transaction in long-term data stores. Small merchants hold hundreds of card numbers on their terminals or in their POS systems. Large retailers have data warehouses containing hundreds of millions of card numbers that they use for marketing and analysis of customer purchasing behaviour. The value of this information makes these data stores a primary target for hackers and criminals. 2. ecommerce and Other CNP Fraud Example of Increase CNP Fraud Losses on Cards (UK) The simplest method for circumventing EMV is to use a stolen card number in a place where EMV validation does not occur, such as in an ecommerce transaction. EMV designed for card-present transactions. EMV validation occurs when the smart chip in the card connects with a reader in the POS terminal. As a result, EMV does not address the fraudulent use of payment data when there is no direct connection, in card-not present situations. EMV rollouts in other countries have shown that card-not present fraud tends to increase initially when smart card implementations drive criminals away from the physical terminals and towards cardnot present uses. Source: First Data 13

14 Tools for Detecting and Preventing Online Fraud Transactions Combating Card Not Present Online Fraud 1 2 Automated Transactional Risk Scoring Involves calculating the potential fraud risk of a transaction based on multiple data factors. The calculated score serves as a relative risk indicator and determines next steps for that transaction according to a merchant s preferred operating procedures. Real-Time Categorizing and Resolution Places transactions with risk scores exceeding certain thresholds into different categories for further action. 3 4 Post-Purchase Transaction Management Allows merchant to review and analyze the transaction that fall between the accept and reject thresholds. Helps merchant resolve chargebacks and disputes efficiently as well as understand transaction trends over an extended period of time. Adjustments to Fraud Rules and Parameters Anti-Fraud tools should be referenced against reports and analytics on a regular basis, and merchants should be trained to immediately react to critical occurrences. Source: First Data 14

15 Tokenization New Security For Payments Overview Tokenization is a method for protecting card data by substituting a card s Primary Account Number (PAN) with a unique, randomly generated sequence of numbers and characters. The token is usually the same length and format as the original PAN, so it appears no different than a standard payment card number to back-end transaction processing systems, applications and storage. The random sequence, or token, acts as a substitute value for the actual PAN while the data is at rest inside a retailer s system. The token can be reversed to its true associated PAN value a any time with the right decryption keys. The token itself would be of little value to data thieves because there would be no way to link the token back to the PAN without the decryption key. Tokenization eliminates the need for merchants, e-commerce sites and operators of mobile wallets to store sensitive payment card data on their networks. Consumers would do nothing different when paying for purchases using a credit or debit card. Encryption vs. Tokenization How Tokenization System Works Encryption is the process of transforming information using an algorithm to make it unreadable to anyone except those possessing special knowledge, or a key. Encryption implemented from point of entry to point of process (End to end). Requires management of encryption keys. With Tokenization, data is neither stored nor sent in any form to its destination. Do not have to manage encryption keys. Provides greater flexibility in choosing what data to encrypt. However company must be able to identify the specific data to encrypt, which requires intimate knowledge of its data profile. Source: ComputerWorld, OnLine Tech 15

16 Tokenizing Mobile Payments Steps of Flow for Payment Token via NFC POS Mobile Payment Tokenization with NFC POS Terminal 1. The mobile device will interact with the NFC terminal thorough the payment application and pass the following key payment token data elements to the Merchant terminal. 2. The Merchant terminal will pass the contactless authorization request to the Acquirer, carrying all of the standard payment token data and contactless data. 3. The Acquirer will perform routine processing checks and pass the token data and the contactless data to the Payment Network. 4. The Payment Network will interface the Token Service Provider to; retrieve the PAN, verify state of the payment token, validate token cryptogram and token restriction controls for that payment token and retrieve token requestor ID. 5. The Payment Network will send the authorization request to the Card Issuer, with replacing payment token information with PAN information. 6. The Card Issuer completes the account-level validation and the authorization check, and sends the PAN back in the authorization response to the Payment Network. 7. The Payment Network may generate a response cryptogram and will replace the PAN with the payment token and will pass certain required fields to the Acquirer as part of the authorization response. 8. The Acquirer will pass the authorization response to the Merchant. 9. The consumer will be notified of the success or failure of the transaction. Source: EMVCo 16

17 Hardware vs. Software-Based Market Scenario Two Most Likely Scenarios 1 2 Hardware/NFC-Based Authentication Hardware-based technologies prevail, with mass adoption of a few dominant digital wallet solutions. Chip-card EMV-based authentication becomes the global standard for authenticating transactions in-store. NFC becomes global standard for mobile payment. Credit cards would remain the funding mechanism for most electronic wallets. Models that seek to monetize consumer data or loyalty schemes may also be challenged. Best Positioned: Card Networks, Issuers, Merchants Potentially Challenged: Wallets, Telecoms, TSMs Cloud-Based Authentication Cloud-based technologies prevail, with concentration among a few dominant digital wallet solutions. Would eliminate the strict need for POS devices. Merchants would likely keep some POS terminals for basic credit card acceptance. Cloud-based authentication dominates offline mobile payments and a few digital wallet providers drive consumer and merchant adoption. Tokenization enables card-present interchange fees for digital wallets, removing a hurdle for merchants. Best Positioned: PayPal, MCX, Google Potentially Challenged: POS Vendors, Telecoms, TSMs Source: Morgan Stanley Research 17

18 Hardware-Based POS Card Readers (Dongles) Industry Profile Mobile devices can now serve as a POS terminal and process transactions replacing traditional terminals. Charge 2.75% per swipe or online sale. 3%-3.5% + $0.15-$0.25 per manually entered transactions Targeted at micro-merchants as 2/3 do not support credit cards. Square has been a very successful provider for this method of payment and have recently released an EMV-compatible reader. Square Has Become a Leader in Card Reader Dongles Increased Competition Etsy, Amazon & Others This summer Amazon took aim at mobile payment systems such as Square by introducing Amazon Local Register, a credit card processing dongle and mobile app for small business owners to accept payments through their smartphones and tablets. Etsy and Ingenico recently released their own POS card reader to compete with Square as an acquirer for micro-merchants and small businesses. Square has officially discontinued its Wallet mobile payment app in favour of Square Order app, allowing consumers to place pick-up orders straight from their smartphones. New competitor Poynt and others crowding smart-terminal market. US Electronic Payment Acquiring Revenue ($ Billions) POS Solution Provider Online B2C ecommerce Traditional F Source: Mobile Payments White Paper, Square, McKinsey, IBM 18

19 Hardware-Based Softcard (Formerly ISIS Mobile Wallet) Company Profile Softcard is a joint venture of AT&T, T-Mobile, and Verizon originated in November Contactless payment underpinned by transactions between smartphones and a POS terminal using NFC technology. Application uses the NFC SIM card in smartphone as the secure element for transactions. Recent Partnerships with McDonald s & Subway Outlook Uncertain Poses large hurdles for mass adoption by consumers. Some key partners such as Capital One and Barclays have dropped support for the app. Recent introduction of Apple Pay creates challenge for Softcard as Apple has disabled third parties from using NFC on new iphones. Google s introduction of host card emulation (HCE) also allows Android users to bypass the secure element which Softcard is based on. Merchants are partnering with Softcard yet they are also partnering with other wallets such as Apple Pay, making Softcard unable to differentiate itself at the merchant level. Softcard Net Income ($MM) $- AT&T Verizon & T- Mobile - $20 - $19 - $20 - $29 - $40 - $38 - $40 - $60 -$57 -$60 - $58 - $80 - $100 -$87 2Q13 1Q14 2Q14 Source: Morgan Stanley Research 19

20 Cloud-Based - PayPal Company Profile Founded in 1998, PayPal is an alternative payment company with over 128 million users globally (55 million in the US). PayPal recently partnered with Samsung to allow PayPal payments on Samsung phones. PayPal excluded from Apple Pay due to Samsung deal. On September 30, 2014, it was announced that ebay would spin off PayPal into a separately publicly traded company. Main Benefits of PayPal For Consumers/Merchants Safe Send money to merchants without giving any payment details. Open Ability to store more types of tender and control payment options. Payment Grace Period Even though the customer is given 5-7 day grace period, merchants receive money up front. Intelligent Different rules for different cards, allowing users to design a more personalized wallet by creating different types of purchases. Convenience Consumers will find it easier to perform a variety of transactions across several use cases. Automated Clearing House (ACH) Solutions such as PayPal and MCX that bypass the network operators through the use of ACH. Main benefit of ACH is that it does not have high interchange fees. Merchants could benefit from lower cost of acceptance. ACH has serious limitations such as lack of authentication and batch processing, which makes it riskier for the digital wallet provider. Issuers are not willing providers of ACH services as it threatens interchange revenue stream. Consumer adoption of ACH is not easy either, and likely explains why PayPal s funding of ACH has been stagnated in past years. Strong Consumer Awareness and Usage PayPal Google Wallet MasterCard PayPas Square Wallet V.me by Visa Softcard 0% 20% 40% 60% 80% Aware of the Digital Wallet Provider Who Used the Digital Wallet Source: Morgan Stanley Research, comscore 20

21 Cloud-Based MCX (Merchant Customer Exchange) MCX & CurrentC The Merchant Customer Exchange is a joint venture of 57 USbased merchants, proposes to offer its own mobile payments solution. MCX merchants have over $1 trillion in aggregate annual sales. Its product, CurrentC, is still in beta testing. MCX s primary objectives is to reduce interchange fees and pass some of those savings onto customers. Bar Code Payments Bar code payments build upon the already mature traditional bar code system which is widely used. Mobile phones can now display either a 1 or 2 dimensional bar and have it scanned at a POS. The best known example of this is Starbucks, which implements a closed system which applies to one merchant and allows for the execution of a payment on a proprietary system. This does not allow for dynamic data. A more open bar code implementation would allow consumers to register accounts with a third party. Security & Other Issues On October 28, 2014, MCX announced that unauthorized third parties compromised the addresses of some people who were testing out its payment system, CurrentC. CurrentC s plans to directly access users checking accounts raises the level of sensitivity. QR codes were halted by China s central bank earlier this year due to fraud concerns. Consumer trust for national merchants as a mobile payments provider is only 37%, below Network Operators, Apple and PayPal. MCX is at risk if Apple Pay takes off as their mobile payments system CurrentC will not be available until next year. MCX members have disabled NFC on their terminals in response to Apple Pay s launch. National Merchant Acceptance Critical to Consumers 71% NaGonal Merchants Most Important Merchants to Accept Mobile Payments 43% Online Merchants 30% 28% Local Merchants Regional Merchants 24% Neighborhood Merchants Source: Mobile Payments White Paper, MCX, McKinsey Mobile Payments Consumer Survey, Morgan Stanley Research 21

22 Apple Pay - New Hardware-Based Payment System What is Apple Pay? Apple s new mobile payment system consists of: NFC chips for tap and pay functionality in the iphone 6, iphone 6 Plus, ipad Air 2 and Apple Watch. TouchID (fingerprint scanner) integration for iphone payment transactions. Updated Passbook App that can now scan and add credit and debit cards that account for 83% of transactions volumes in the US. Online and in-app integration for one-click payments. The key value proposition to consumers is that Apple Pay is easy compared to existing wallets (consumers do not have to unlock their phone to use Apple Pay), secure (a token-based system will minimize instances of fraud), and addresses potential privacy concerns (Apple will not have access to transaction data). Apple Pay The Tipping Point of Mobile Payments 1. Apple has a proven ability to change consumer behaviour. Have almost 40% market share of smartphones in the US in combination with a simple user experience can reduce friction. 2. Issuers representing 83% of credit/debit card volumes in the US are a part of Apple Pay. Apple Pay is working collaboratively with the existing payments ecosystem which helps reduce fiction. 3. The timing of the Apple Pay launch ahead of the EMV upgrade cycle could help mobilize NFC adoption. Less than 5% of merchants in US support contactless payments. Apple Pay can be the catalyst to drive retailers to adopt NFC capable terminals. 4. Tokenization combined with TouchID should help drive confidence in security. Consumers are concerned about security and privacy when it comes to mobile payments adoption. Apple Pay is more secure than current methods by only storing tokenized credentials on the secure element. 5. Apple is staying away from transaction data. Major problem that merchants and issuers had with Google Wallet. Source: Morgan Stanley Research, Apple 22

23 Apple Pay Continued Value in Extra Volume and Decreasing Fraud Costs Accounts for 1% of All Whole Foods Transactions In 2012 the US accounted for 23.5% of payment card volume but 47.3% of payment card fraud. Although Apple Pay takes 15 basis points for every transaction, the increased security of payments will be able to offset this cost from decreases in fraud costs to issuers and merchants. Fraud costs average 3-10 basis points currently and expect to be lower in the tokenized Apple Pay wallet. Higher volume on Apple Pay means more card spend and less cash spend. A 2.5% increase in card spend from cash migrating to card would offset the interchange fee to Apple for issuers. Weaknesses Payment Flow of Apple Pay Apple Pay will only be available on its newest hardware devices, which will restrict consumer adoption of people with older iphones. Older iphones do not have NFC capabilities required for Apple Pay to work. MCX merchants such as Walmart, Target, and CVS have disabled the NFC ability of their POS terminals in an attempt to limit Apple Pay s acceptance. MCX members prohibited from accepting all third party mobile wallets for an extended period of time (early 2015). At the time there is no loyalty offerings that would enhance the value proposition of Apple Pay. Source: Morgan Stanley Research, Apple, BI Intelligence 23

24 Advantaged and Disadvantaged Players From Apple Pay Advantaged Disadvantaged 1 Card Networks 1 Trusted Service Managers (TSMs) Positive for volumes as small-ticket mobile payments could accelerate share shift from cash to electronic transactions and keep fraud prevention standards under control of main networks. Move for Visa, MasterCard and Amex to provide tokenization services to Apple Pay represents a major challenge to independent TSMs such as Gemalto. 2 Issuing Banks 2 Telecoms Apple Pay and other mobile wallets largely based on already issued cards (or tokens linked to those cards). Any additional costs for banks for inclusion in 3 rd party wallets should be offset by increased volume. Apple has disabled any third parties from using the iphone s NFC chip. Softcard unable to be used on iphones. 3 Acquirers/Processors 3 PayPal and Other Wallet Providers Mobile payment system based on existing infrastructure Can use tokenization to significantly increase the safety of electronic payment transactions. 60% of PayPal s account funding comes from credit/debit cards, which are treated as CNP transactions by the networks and attract higher interchange costs than applicable to Apple. More expensive for merchants to accept, resulting in slower adoption. Source: Morgan Stanley Research 24