Another Important Benchmark On The Road To Mobile Payments

By Matt Pillar, editor in chief

Mobile POS took another leap forward late last month with the release of Visa's official "mobile acceptance best practices," a comprehensive compilation of considerations for merchants, software developers, and mobile device manufacturers interested in jumping on the mobile payments bandwagon.

Mobile POS is inherently card-based, so Visa's leadership here is a welcome and necessary development.

As you might imagine, a significant portion of Visa's effort focuses on security. The acceptance of credit cards at the fixed POS and in CNP (card not present) scenarios such as MOTO (mail order/telephone/order) and E-commerce is a well-paved road, but the proliferation of mobile devices equipped to take payments has, to this point, exceeded the industry's effort to educate users and ensure the security of those payments.

Of primary concern is the mobility (or "losability" for a lack of a better real word) of the devices retailers and consumers are now able to use for the facilitation of payments. While an enhanced customer experience is the goal of mobile payment acceptance, device-level storage and wireless transmission of cardholder data is not to be ignored. Hence the prescription by Visa that, similar to the way fixed-POS card payments are handled, cardholder data processed and transmitted in mobile fashion must me adequately encrypted and tokenized.

Following are highlights from Visa's best practices statement, which can be read in its entirety at www.visa.com/cisp.

• Encrypt all account data including at the card-reader level and in transmission between the acceptance device and the processor — especially important given the use of wireless or public networks.
• Enable truncation or tokenization of card numbers, allowing the merchant to identify the cardholder without storing the full account data.

In addition, vendors, merchants and acquirers are expected to follow Visa's requirements for magnetic stripe, chip, and contactless acceptance, not to mention the Payment Card Industry Data Security Standard (PCI DSS) and Payment Application Data Security Standards (PA-DSS). Visa also advises that acquirers must also be in compliance with "local laws and regulations regarding sponsored merchants, including adequate Know Your Customer (KYC) and Anti-Money Laundering (AML) due diligence."

While mobile payment acceptance is a transformative development in retail technology, the potential for fraud puts its adoption at risk. Card breaches suffered at the hands of poor mobile payment acceptance practices will result in loud, negative exposure that hampers mobile adoption on the whole and creates wariness on the part of consumers. Worse, those breaches will be associated with specific retail brands. Make sure yours isn't one of them.

For more thoughts on Visa's mobile payments best practices announcement, check out the comments of Verizon's David Tran (Enterprise Technology and Vertical Solutions Architect) and Jen Mack (Director of Global PCI Consulting Services) here. (https://www.verizonbusiness.com/blog/retail/?postid=413#comments)