At more than 150 merchant locations in Malaysia’s capital of Kuala Lumpur, consumers are testing a new contactless payment card from Visa. Called Visa Wave, the trial is Visa’s first foray into contactless consumer payments. It is significant because it is brings the world’s largest card association into the contactless payments landscape and it marks a significant security increase from previous contactless offerings. Namely Visa Wave conducts its transaction using a cardholder authentication component found in the EMV specification for secure card payments.
Why is this EMV-like security component significant? Visa and Mastercard together have mandated that all point-of-sale (POS) devices worldwide be converted to utilize the EMV specification. EMV outlines a secure handshake between a card and the POS that was developed by Europay, Mastercard, and Visa (thus the name EMV). It helps to eliminate the massive levels of fraud that occur using counterfeit cards and card skimming techniques. Though much of the world is already migrated to EMV, the transactions remain the exclusive domain of contact chips. Visa Wave, however, is taking this important concept from EMV and using it in the contactless realm. Perhaps this effort could help in the migration of the true, complete EMV specifications into the contactless payment world.
“Visa’s vision is toward universal commerce,” says Sue Gordon-Lathrop, VP Emerging Consumer Environments for Visa International, “to empower consumers to conduct commerce anytime, anywhere, anyway.”
Though this Visa Wave pilot is receiving a great deal of attention, Visa has actually been working with radio frequency technologies for payment for a number of years. Say Ms. Gordon-Lathrop, “our first pilot was actually in Finland with Nokia and Nordia bank. It combined RF and a Visa payment application on mobile phones.” The pilot has ended, but the positive consumer response encouraged Nokia to develop handsets to make the application widely available.
Details about the Malaysian pilot
The Visa Wave trial is being conducted by Visa Asia Pacific. The cards are issued by one of Malaysia’s leading card issuers and merchant acquirers, MBF Cards. During the four month pilot, which will run through the close of August, 2000 consumers will have the opportunity to use the new cards.
The 150 merchants participating in the pilot include pharmacies, fast food restaurants, department stores, grocery stores, and specialty retailers. Specific examples include: Caring Pharmacy, Delifrance, Dunkin Donuts, Fajar Dept Store and Supermarket, Famous Amos, Hoca Coffee, Toycity, Victoria Music Centre, Memory Lane, and Hallmark. The plan calls for new merchants to be added during the pilot.
The card is a dual interface variety enabling both contact and contactless communication with the card’s single chip. This enables the EMV transaction to be conducted using Visa Wave at participating merchants or via the traditional contact EMV interface at other Visa-accepting merchants not participating in the trial. As with all Visa chip cards, a magnetic stripe is also included on the card to enable a worldwide level of acceptance. Thus the card can essentially be used anywhere payment cards are accepted. The chip is from Philips and runs the Visa JCOP30v2 platform on the IBM Java Card/GlobalPlatform (JC/GP) operating system.
In Malaysia they are using a form of Dynamic Data Authentication (DDA) to authenticate card to reader and reader to card. DDA is a key component of the EMV security specification. By validating the card prior to the transaction, the opportunity for counterfeit card to be accepted or skimmed card numbers used is greatly reduced. According to Ms. Gordon-Lathrop, by limiting Visa Wave to this one component of EMV, a significant level of security is achieved and the transaction can still be conducted in less than one second.
Visa Wave is designed to allow region-by-region flexibility
But the Malaysian pilot is not the only methodology available for Visa Wave rollouts. “Our proximity payments specification provides flexibility to our regions and issuers with regard to how Visa Wave operates,” says Ms. Gordon-Lathrop. It can be PIN-protected or non-PIN protected; it can require a signature or not; it can be online or offline; it can use some, none, or all of the EMV components.
According to Ms. Gordon-Lathrop, the realization that flexibility was a necessity came from their experience with other RF payment pilots. “Originally we thought that RF would be used for small value transactions only,” she reports. “But we realized that customers did not always see this distinction. We have a mobile payment projects in Japan where the average transaction is US$39 and another in Korea where the average is US$43.” While these programs utilize a mobile phone and transmit the magnetic stripe data to the POS via infrared technology, Ms. Gordon-Lathrop stress that to the consumer this is not important. It is simply another option in Visa’s vision for universal payments.
The use of a 13.56 Mhz contactless chip compliant with the ISO 14443 specification is specified in the document titled “Visa Specification for Financial Messaging for Contactless Payment.” It states, “To provide international interoperability, POS devices shall support both 14443 A and B. Cards shall support either A or B. Both POS devices and cards may additionally support other proprietary contactless interfaces for use in domestic programs.”
When asked about other form factors, she reiterated a preference for the mobile phone. “Mobile phones are a great form factor. The phone in Asia Pacific has transit, messaging, cameras … Putting the mag stripe info into the phone makes perfect sense to these consumers.” A phone can be used to password protect the payment application and it makes the integration of fingerprint or voice recognition for local verification of the user to the device a very real possibility.
What’s next for Visa Wave?
“The RF technology is tried and true,” says Ms. Gordon-Lathrop, “so to call the project a pilot is actually a bit of a misnomer. It is really an effort to learn more about consumer and merchant desires and usage patterns so that we can better serve them.”
“We fully expect Visa Wave to rollout,” she concludes.
VISA Financial Messaging Specification for Contactless Payment, Version 1.4.1
Published by Visa International on December 21, 2003 (requires registration)