Credit Card Processing Blog

I’ve wanted to write about this subject for quite some time and this morning I was given the opportunity I’ve been waiting for. Last year we received a lot of pushback for our post about Dwolla, a person-to-person (P2P) mobile payments provider. Many readers didn’t like our conclusion that the start-up simply stood no chance as a stand-alone service, because the big banks would, sooner rather than later, come up with a very similar service and would be offering it for free.

Well, Barclays, a big British bank, has just launched Pingit – a P2P mobile payments service that allows Britons to send and receive money through their phones, for free. Consumers without a Barclays account can only receive payments, but the bank promises that they would “soon… be able to send money too.” I don’t know about you, but that sounds to me like a description of what Dwolla does, up to the pricing thing. And if Barclays is doing it, its American cousins will be doing it soon enough too.

Dwolla’s Problem

Let me re-post our take on Dwolla’s prospects, as we saw them in July of last year:

But it is something else that makes me really question the future of Dwolla and similar services and curiously I haven’t read about it anywhere – the fees they charge. At $0.25 per transaction, you would need many millions of them to make any kind of profit that would justify the effort. A million transactions, which could be what the start-up is currently processing monthly, only translate into $250,000 in revenues. The problem is that Dwolla cannot charge more than that; banks are doing it for free!

The Takeaway

I am quite skeptical about Dwolla’s prospects. I just don’t think that its business model, in its present form, would allow the start-up to achieve any significant scale. Their only chance, as I see it, is to quickly sign up as many banks as they can (Dwolla says they have currently signed up 15) and let them use their technology. The problem is that banks are already developing their own system and JPMorgan Chase, Bank of America and Wells Fargo have said that clearXchange will be open to other banks. To make matters worse for Dwolla, PayPal is spending heavily on its own P2P platform and it already has built a huge customer base and online presence.

So I think that the start-up should prepare itself for a long, hard slog.

I don’t think that I would’ve changed a word in the above paragraphs, if I had to write them with the benefit of today’s perspective.

Today’s Perspective

Many readers of our original Dwolla post repeatedly told us how great the company’s service was and I have no reason to doubt that assertion. In fact, we did congratulate the start-up on their fast growth, especially considering the fact that they reached $1 million in daily transaction volume in a shorter amount of time than it took the far-better funded and publicized Square. That was a great achievement and ours was not a backhanded compliment.

All that, however, doesn’t take anything away from the fact that Dwolla, unlike Square, has set out to compete in a sector that banks care very much about. What makes Square so successful is not its technology, which has been easily replicated by Intuit GoPayment and many others, but rather its business model. See, before Square only businesses could accept credit cards for payment. Banks simply didn’t offer the service to consumers. Jack Dorsey’s company changed all that and was the first one to enable everyone to take cards.

P2P bank transfers, which are what Dwolla facilitates, are different. This is bank-backyard territory and banks have been providing various such services for a long time and for free, although transfers have so far only been possible between customers of the same bank. Dwolla, of course, took it a step further by facilitating P2P transfers between different banks and by funding the recipient’s account instantaneously. But that’s not enough of a competitive advantage, as the Barclays example makes clear.

The Takeaway

So Dwolla is still facing an uphill climb, only that the company now has less time to get to the top. But what would a successful climb look like for Dwolla? Last year we contended that their only chance was to sign up as many banks as they could and let them use their platform. In essence, that would turn them into a technology company, not a payments one.

I still think that this would be the best, and very possibly the only positive, outcome for the start-up. Dwolla could be doing that as an independent company or, which is the much more likely scenario, it could be acquired by a bank, which would use its system. That would not necessarily be a bad exit for the Dwolla guys. In fact, if they time it right, it could be a very lucrative one indeed.

Image credit: Barclays.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

Square is everywhere these days. You can find it at farmers markets, fairs, hot dog carts and I recently read somewhere that Barack Obama and Mitt Romney will be using the service to accept credit card donations in their fund raise drives. So it seems to me that by now anyone who ever had doubts about the merits of Jack Dorsey’s mobile payments idea should have been won over.

But why has Square been so successful? It has plenty of competition and at least one of its rivals – Intuit’s GoPayment – has mounted a solid challenge, offering reliable service at rates that seem to be better than Square’s. And yet, it is Jack Dorsey’s card reader that is sold at an ever increasing number of retailers, ranging from Apple to T-Mobile to Wal-Mart. And it is Square that is making the mobile payments headlines. Why is that? What makes Square so much more successful than its competitors? Well, there are several reasons, but at the core of Square’s dominance is the company’s commitment to transparency and simplicity. Let me elaborate.

Square vs. GoPayment Redux

We first weighed in on the Square vs. GoPayment issue more than a year ago, but both companies have since tweaked their pricing models and we now have more information to consider. And when you look closely into the details, you understand why Square is winning the war.

At first glance it looks as if GoPayment’s pricing model is slightly better than Square’s. Intuit’s outfit states it charges 2.7 percent for swiped transactions and 3.7 percent for key-entered ones and the company has an even better-looking plan for “high-volume” applicants, with rates of 1.7 percent and 2.7 percent, respectively. The corresponding rates for Square are 2.75 percent and 3.5 percent plus $0.15 per transaction.

However, this is not the whole story. Not for GoPayment that is. When you begin digging deeper into GoPayment’s pricing disclosures, you find that there is more than meets the eye. Here is how the fine print reads for the 2.7 percent / 3.7 percent plan:

* “Card-Swiped Rate” of 2.70% will be charged on qualified swiped Visa/MC/Discover Network transactions that are electronically authorized.  “Key-Entered Rate” of 3.70% will be charged on all qualified manually keyed Visa/MC/Discover Network transactions that have AVS. All Visa/MC/Discover Network transactions that do not meet the requirements stated above, business cards, foreign cards and transactions that do not meet Visa/MC/Discover Network requirements for the best interchange program will be charged a “Non-Qualified Rate” of 3.70%. Non-Qualified transactions are charged an additional $.07 each. Different discount rates for American Express may apply. Card-swiped rates require a reader available, sold separately. Card reader functionality not available for all services.

** 0.30% downgrade will be charged for transactions whenever a CNP or Card Not Present Charge occurs. CNP means a Charge for which the Card is not presented at the point of purchase (e.g., Charges by mail, telephone, fax or the Internet), is used at unattended Establishments (e.g., customer activated terminals, called CATs, or which the transaction is key-entered).

The corresponding disclosure for the 1.7 percent / 2.7 percent plan is almost identical, with the differences being that the “2.70%” and “3.70%” rates in the first two sentences are replaced with “1.7%” and “2.7,” respectively.

Square, on the other hand, charges 2.75 percent for all swiped Visa, MasterCard, Discover and American Express transactions and 3.5 percent plus $0.15 for all key-entered ones. Period.

I could go on calculating what the real GoPayment average rate would be, based on what we learned in the disclosures and on industry averages of “qualified” versus “non-qualified” transactions (and it would be much higher than Square’s), but that would be entirely beside the point. The point is that when you hide the real cost of your service in the fine print, you alienate your potential customers. I think that goes a long way toward explaining why Square is so successful in signing up new users, while GoPayment is not. But Square’s success extends to winning over big-name partners as well.

Why Apple Loves Square

Square is sold in Apple’s online and physical stores, as well as in Wal-Mart and in many other big-name retailers, while GoPayment is not (with the exception of Verizon). Why? Well, for the same reasons that make Jack Dorsey’s proposition so irresistible to end users: transparency and simplicity. The only difference is that, while you can fool some consumers, you can’t do so with many of these retailers.

Many users will never read either Square’s or GoPayment’s full service agreements. Most will rely instead on what they hear from friends who have used these services and what they read about them. However, any retailer will minutely examine all aspects of the service, including the entire user agreement, before deciding on whether to put it on its shelves. Retailers can’t take chances, because customer discontent with anything purchased at their stores will first be directed at them, even though someone else actually provides the service. Is it surprising then that retailers choose Square over GoPayment?

The Takeaway

So it is absolutely no surprise that Square should be winning the mobile payments war. The company has put everything on the table and is hiding nothing underneath it. Of course it helps that Square has raised many tens of millions of dollars from investors and has been spending it with abandon on advertisement.

But it is also a fact that Jack Dorsey and company are the ones who lead and innovate, while all of their competitors are merely imitating what Square does and trying to put a better spin on it. However, end users like the original much better, and for good reason.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

As regular readers of this blog know very well, we love the concept behind Google Wallet here at UniBul Merchant Services. We believe that every digital wallet, just like its physical counterpart, should allow its users to store in it all types of payment methods they may want, including bank cards issued by different banks and bearing different brand logos. And Google is offering precisely that.

However, data security is even more important than convenience and user-friendliness. In fact, your service should not be made available to consumers until your system can be guaranteed to protect your customers’ personal information. And that apparently is not the case with Google Wallet.

How to Crack Google Wallet in Seconds

The good people at Zvelo have done a lot of work evaluating Google Wallet’s security credentials and have found them wanting. They have built an app that can enable anyone to retrieve your Google Wallet PIN, if they can get their hands on your phone. They have even posted this video to show you how quickly and painlessly this is done:

Now, this Zvelo app may not be made available for download on the Android Market anytime soon, but the bad news is that it is apparently incredibly simple for anyone with a relatively modest amount of technical skills to replicate it. There is a lot of technical jargon in Zvelo’s explanation of the hack, but here is the gist of it:

The lynch-pin, however, was that within the PIN information section was a long integer “salt” and a SHA256 hex encoded string “hash”. Knowing that the PIN can only be a 4-digit numeric value, it dawned on us that a brute-force attack would only require calculating, at most, 10,000 SHA256 hashes. This is trivial even on a platform as limited as a smartphone. Proving this hypothesis took little time.

Google Wallet allows only five invalid PIN entry attempts before locking the user out. With this attack, the PIN can be revealed without even a single invalid attempt. This completely negates all of the security of this mobile phone payment system.

There it is, hacking Google Wallet is “trivial.”

Who Should Be Responsible for Keeping Your PIN Secure?

The Zvelo guys tell us that they immediately contacted Google, alerting them of the vulnerability they uncovered and the search giant “was extremely responsive to the issue, but ran into several obstacles preventing them from releasing the fixed app.” Then we are walked through the obstacle course, which I will spare you, but the interesting part comes at the end of it.

It turns out that when the Google engineers did find a fix for the vulnerability, they promptly ran into another issue, one for which there was no technical solution. “[W]ith the proper fix in place, the PIN will be nearly impossible to crack,” the Zvelo guys assure us, however, the securing of the user’s PIN may “constitute a “change of agency” responsible for keeping the PIN secure.” So not Google, but the card issuer would be the responsible party.

We don’t yet know whether the banks would agree to this “change of agency” thing, but my guess is that they would accept it. There is no doubt in my mind that eventually the NFC technology that is behind Google Wallet will be every bit as secure as any other payment technology, so the banks’ liability will decrease greatly over time. Moreover, being the party responsible for the security of the users’ data will put the issuers in a much better bargaining position when negotiating the terms of their partnership with Google.

The Takeaway

Google Wallet has been in the news, and on the pages of this blog, for so long now that you may be forgiven for thinking that you may be the only one not using it. Well, you may take comfort in the knowledge that the exact opposite is actually true: there are very few Google Wallet users at present. Moreover, there are only two phones on the market today which support it: Google’s own Nexus S and Galaxy Nexus.

So, if there was ever a good time to be uncovering security shortcomings in the service, it would surely be now. Yet, I don’t think it is too much to expect that hacking the current wallet version would not be a “trivial” exercise. I almost get the sense that Google doesn’t care about understand the importance of protecting its customers’ personal information. I can only hope to be proved wrong.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

In a two-sentence announcement Bango, a smallish provider of mobile payments services, told us on Wednesday that it had “signed an agreement to provide payment services to Facebook.” No details of the deal were disclosed. Moreover, “it is too early in the relationship to accurately forecast the level of business which it may generate,” we are told.

Yet, scant as the information may be, the deal does provide a clue to at least one of the possibilities which Facebook might be testing, as it is looking for ways to monetize the mobile traffic to its website. At the same time, taking this path will very possibly (make this inevitably) lead to another confrontation with Apple and Google, the social networks’ sometime rivals. And for good reason – there is a lot of money at stake.

What Facebook Gets

Bango has developed a platform, which, as the company tells us, “is operated on a white label basis for app stores, and can be used by individual content providers and app developers to sell direct to customers.” One of the users of Bango’s platform is BlackBerry maker Research in Motion. Amazon also inked a deal with Bango last December.

The part that is most interesting to Facebook is very likely to be the direct-billing component of Bango’s service. When a purchase is completed at a Bango-powered app store, the sale’s amount is charged to the customer’s mobile phone bill, sparing the user the inconvenience of having to enter credit or debit card numbers and other payment information into her phone. In fact, the customer may not even have a bank card to begin with. But, as far as Facebook is concerned, the best part is that the social network’s cut from such a transaction would be 30 percent. The thing is that both Apple and Google are also very much interested in these 30 percent.

Facebook vs. Apple and Google

More than 350 million people access Facebook from a mobile device every month. About half of them access the social network directly through a mobile browser and the other half – through a mobile application that is specifically designed for their device and operating system.

And here is the thing. When one of these visitors, say an iPad user, hits the Facebook icon on her tablet and then wants to download some Facebook app, she will be directed to Apple’s app store and, upon completion of the transaction, Apple will pocket the 30 percent commission.

However, things look very differently if the same iPad user accesses the social network through her iPad’s browser instead and still wants to buy the same app. In that case, she will be directed to the app developer’s website to complete the download. At present, this payment can only be completed in Facebook Credits, the network’s digital currency in which developers are required to sell their apps, and Facebook, not Apple, will collect the coveted 30 percent commission. Not to mention that Facebook will have already pocketed 10 percent of the sale’s amount, because it charges buyers of its currency $0.10 per credit. Pretty neat, isn’t it?

Once Facebook has implemented Bango’s platform, app developers would presumably also be allowed to get paid in real dollars, perhaps in addition to Facebook Credits, and the customer would have the option of charging the sale’s amount to her monthly phone bill.

Moreover, now that Facebook’s platform is open to all mobile developers, Facebook apps can be built outside of the Apple and Android app markets and the social network can collect its 30 percent regardless of the path a user had taken to get to the source of such an app.

The Takeaway

So the Facebook / Bango deal can turn out to be quite significant. It seems a sure bet to me that the social network will do everything it can to make it more attractive and convenient for its users to download third-party Facebook apps directly from the developers, cutting Apple and Google out of the cycle in the process. After all, why let the competition get these 30 percent, which could very well be yours? And Bango’s direct-billing platform could play a crucial role in that strategy.

Of course, Apple and Google will be pursuing precisely the opposite objective and they have the resources to make a fight of it. But it seems to me that, fighting on its own turf, Facebook has the upper hand here.

Image credit: Midias Sociaiss.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).

Yesterday I read a review of Square, Jack Dorsey’s fast-growing, extremely well-funded and hugely publicized mobile payments venture, on CardPaymentOptions.com. The review was, I think, a good and fair one. The author, Phillip Parker, does give Square credit for its innovative and affordable service that makes it easy for everyone, not just businesses, to accept credit cards on very affordable terms, while at the same time he gives the company low grades for the quality of its customer service and its Better Business Bureau record. Apart from the BBB grade, I accept Parker’s assessment.

However, what I found much more valuable was what I read in the comments underneath the review. Most of them were negative and quite a few were very negative. There were two overarching issues that were behind the commenters’ gripes: the inability to easily speak to a Square customer service representative and the holds the company places on its users’ funds under certain conditions. I’m sure that anyone with experience in our industry is nodding their head now. We know how big these issues are and I, for one, have been very curious to see how Square users would respond to the company’s policies. We are now beginning to get an answer.

When You Need to Speak to Someone

As anyone in the payment card industry world whose job has at any time involved some form of client support knows, when a merchant has a payment-related issue, they want it resolved immediately. Email is very rarely an acceptable communication channel; a merchant in need of help needs to talk to a live person and wants their call to be answered promptly.

This is why we at UniBul Merchant Services (a shameless plug, I know, but a fact nonetheless), as well as many of our competitors, provide 24 / 7 client support by phone. Now, you don’t have to offer a 24 / 7 sales line (we certainly don’t), as the person who’s inquiring about your service will not make a buying decision for at least a few days. But a well-staffed client support center, able to quickly take all incoming calls, is indispensable.

Now back to Square. It turns out that the company does have a support number, but it is nowhere to be seen on its website and users have to Google it, in order to locate it. It almost looks as if Square is hiding it. Many of the commenters who have called the company say that they have not been able to speak to anyone there and that their calls have never been returned. The callers with a positive experience are in a distinct minority.

If it does care about its image and long-term prospects, Square must clearly state its client support number on its website and be sure to handle all incoming calls quickly and professionally. There is no alternative and the sooner the company understands that simple fact, the smaller the damage. Still, I find it incredible that Square, with a former PayPal executive as a COO, needs convincing on this point.

When You Need to Get Access to Your Money

The other big grievance voiced by Square users has to do with the company’s policy for holding funds, under certain conditions. Here is what Square’s User Agreement says:

If you accrue more than $1,000 in card-not-present sales during any trailing seven day period, Square will defer depositing the amount in excess of $1,000 for 30 days. For accounts likely to exceed $1,000 in card-not-present sales per week, contact Square support to inquire about accelerating your payout schedule. Upon receiving this request, or once you exceed $1,000 in weekly card-not-present sales, Square will conduct a review of your Square Account to determine if you qualify for acceleration. Square will consider a variety of factors in making its decision, including but not limited to a proprietary set of rules, chargeback rates, transaction behavior, and other supplemental data about your business.

There are two issues with this statement. The first one is that very, very few people will read it, before signing up for the service. The second issue is that, even if they know about this clause, users will still resent it and that point is made very clear in the comments. You can read all kinds of hold-related horror stories there. Some of them may not be true, but the problem is that they are much more salient, and more numerous, than the positive comments.

Unfortunately, dealing with the hold issue is not nearly as straightforward a matter as the one of the phone number. See, Square uses the hold is a risk management tool. The only way around it would be for the company to start evaluating applications and approving processing volumes on an individual basis, much like what a traditional processor does. That way every user will know full well and in advance what their approved processing volume is and what will happen if they exceed the stated limit. The problem with this approach is that it is much more cumbersome than the current procedure and it will delay the sign-up process. So I don’t think Square will go that way.

The Takeaway

Now, when we talk about the issues users have with Square, we should keep in mind that the company signs up tens of thousands of new users each month. When the numbers are so huge, even a very small percentage of discontented customers will represent a very large group. And, as the comments on the CardPaymentOptions.com review make it clear, dissatisfied users are much more vocal than satisfied ones.

Yet, these negative voices also present Square with an opportunity to improve the quality of its service. The company should listen to its users and make adjustments accordingly. It should start by prominently displaying a phone number on its website and staff its support center with enough people to be able to handle all incoming calls. As discussed, resolving the hold issue is a trickier matter, but at the very least Square should do a better job at communicating its present policy.

Learn how to lower your card acceptance cost

Learn how to accept credit and debit cards at the lowest processing costs. The Payment Card Acceptance kit contains a video and an e-book:

• Video – Card Acceptance Best Practices for Lowest Processing Costs (18 min).
• E-Book – Payment Card Acceptance Guide (19 pages).