PaymentsJournal

Organizations turn to fintechs for payment solutions that are as efficient and seamless as the transactions they facilitate. However, behind these smooth interfaces lies a labyrinth of challenges. Security concerns, regulatory compliance, and constant technological upgrades are just a few of the hurdles fintechs must navigate to provide what appear to be simple solutions. For clients, the expectation is straightforward: a payment solution that works flawlessly. The intricate complexity involved in meeting this expectation, though, often goes unnoticed.

It’s easy to make something simple complicated. But it’s difficult to make something complicated simple. In a recent PaymentsJournal podcast, Kieran Draper and Tom Jennings, the U.S. and EU/UK CEOs of B4B Payments, and Brian Riley, Co-Head of Payments at Javelin Strategy & Research, spoke about the strategies fintechs employ to ensure their solutions remain both effective and invisible to the user. Highlighted is the delicate balance between simplicity and complexity, especially in the world of international embedded payments.

Ideally, payments get processed with the press of a button, no different from dialing a number and knowing, without having to think about it, that the right person will answer. Customers making payments expect something simple and effective.

But it’s a challenging environment for fintechs right now as they try to deliver that experience, with their funding drying up and regulators coming down on them. On the upside, it’s also a vibrant market. Demand is expanding, as more and more businesses seek to make payments across geographic boundaries and across platforms.

“For a fintech like us, there are a tremendous number of things that we need to take into consideration,” Draper said. “The transactions need to be secure, we have to be compliant in multiple jurisdictions, and the solution needs to be auditable. The trick is to try and figure out how to present a solution to these businesses that shields them from all of this complexity.”

One area with great complexity for companies is offering services across borders and the need to juggle varying regulations and payment methods. To take one example, B4B works with maritime businesses that make and receive payments in multiple currencies, preferably on local rails to keep the costs down.

“Sometimes a ship won’t be allowed to leave port, for example, until they’ve made a payment,” Jennings said. “They need to provide the proof of payment. Traditional banks don’t provide you that information in an easy way, but with our platform, you can just download proof of payment and show it to the port authorities, and the ship can leave the harbor.”

This is the essence of “embedded finance”. When they subscribe to a payment solution, they can embed it into their experience to the point that it becomes transparent to anybody who has to interact with it.   

Another layer of complexity comes from the increasingly stringent anti-money laundering (AML) laws, consumer protection regulations, and information risk management requirements. Navigating these regulations is a daunting task for clients. In the U.S., multiple layers of federal and state AML laws create a challenging compliance landscape, while globally, each country has its own specific AML requirements that continuously evolve. Managing these diverse and ever-changing regulations is an overwhelming burden that clients cannot be expected to handle on their own.

“The market is moving so quickly that you can’t even imagine where we’ll be six years from now, let alone six months,” Riley said. “Regulators have to be more conservative, because they don’t know where the markets are actually going. And then you have business risks that move quicker. Fraud increases when criminals can move quicker than large institutions. Just being able to keep the pace becomes essential.”

“The bar is so high now,” Jennings said. “It’s not just what’s current, but it’s also the horizon planning. You’ve got Dora in Europe, you’ve got PSD 3 coming up, and we’ve got no doubt new AML directives around the corner. It’s constant.”

To help address this, B4B has built a single global platform that is common across all territories of the world, with a single global data processor and a single set of APIs. That allows customers to subscribe to one solution, one set of services that gives them access to tremendous capabilities in the background.

B4B’s channel partners are typically very well established in their own industries and have tremendous experience, but they are also busy and expanding. They are typically good at managing their core business and managing their own customers. But they’re not adept at managing the payments or banking functions that they need to operate smoothly.

Universities are a great example. The payment functions that go with a university’s basic functions are incredibly complicated. Tuition is coming in directly as well as through multiple government sources and scholarships. There’s a whole infrastructure for things like tickets to football games or baseball games, with maybe a different one for the arts department. The best strategy, and the best use of resources, is to let the university target what it needs to do and let the back-office functions get optimized.

“They can very easily find justification for working with a fintech like us,” Jennings said. “Both the students and the administration can see exactly in real time how their money is being spent. It’s convenient for the students, because they’re not very good at handling physical cash and loose cards and that kind of stuff. And we can manage all of that.”

Simplifying financial services is vital to retaining customers. Organizations of all sizes and services must make the complexities of payments invisible for their clients—no matter how complex those things are for the back office.

With gift card spend projected to reach $267.3 billion by 2028, it’s clear that gift cards  are an influential force in the market. And the rise of digital gift cards, a trend that continues to gain momentum, is opening up new avenues to engage younger generations.

During a recent PaymentsJournal podcast, Blackhawk Network’s (BHN) Sarah Kositzke, Director of Research and Hilary Spidaliere, Director of Product Marketing, as well as Jordan Hirschfield, Director of Prepaid at Javelin Strategy & Research, explored, analyzed, and amplified the insights from this year’s Benchmark Report: 2024 Digital Gift Card Leaders, conducted by NAPCO research in partnership with BHN. This market-leading report on the gift card industry, which evaluated the digital gift card programs of 100 U.S. merchants, identifies best practices and opportunities for how retailers can optimize their own gift card programs.  

During the 2023 holiday season, the average individual received around three gift cards, totaling roughly $160 in value. However, when recipients made their purchases, they spent an average of $78 more than the card’s value1. Leveraging a gift card to purchase a bigger-ticket item is commonplace and one of the reasons why gift cards are so valuable to retailers – driving that additional overspend and store visits.

“About a third of people said their favorite gift was a gift card,” Kositzke said. “Most people are still getting single-branded cards, like Starbucks or Amazon, which account for 75% of gift card buys. The Visa and Mastercard options and multi-branded cards are picking up steam though1.”

According to BHN, 77% of purchases were physical cards, even when the transactions occurred online. Physical cards are considered more personal, especially when there’s an option to customize the card. Despite the increasing popularity of online shopping, most gift card transactions still happen in-store, making up 85% of purchases1. But that is likely to change.

“Looking a little further out to 2030, digital cards are going to continue to gain ground,” Hirschfield said. “By the end of the decade, it’s likely to be a 50/50 split. That’s driven by Gen Z and Millennials, who are also significantly more likely to extend their purchases beyond the gifted amount. Digital options are going to be a great way to reach those generations.”

NAPCO Research, in partnership with BHN, examined the gift card programs of 100 U.S. merchants with a specific emphasis on the e-commerce gift card experience. NAPCO developed 130 criteria, across to four major categories.

“First and foremost is discoverability,” Spidaliere said. “How easy is it to find that brand’s gift card program? Next, they’re looking at personalization. Can I pick my own gift card design, or add a personal message? Third, they’re evaluating the checkout experience for efficiency and payment flexibility. Finally, they’re evaluating the recipient experience. Does the card feel like a gift? Is it easy to redeem?”

The end goal was to fully evaluate the purchase and recipient experience for each of the merchants across all platforms.

Speaking to the assessors who reviewed each gift card program, “They’re like a secret shopper,” Spidaliere said. “During the process, they capture hundreds of screenshots and use them to score each of the merchants across the established criteria. Then they crunch the numbers and not only come up with the rankings list, they also identify industry trends and best practices.”

One of the main takeaways from the study is there’s plenty of room for improvement—even for the companies that ranked in the top ten.

“Everybody across the board has something that can be fine-tuned,” Kositkze said. “These are opportunities to drive additional revenue. It could be the placement of cards  or making the most of the fact that 9 out of 10 people are buying other gifts are the same time they’re buying gift cards. That’s a perfect chance to build loyalty1.”

The report found several common denominators among the bottom 20 companies. For one, they were less likely to sell cards across all their devices and channels. Lower-ranked companies were also less likely to support gift card purchases in their app, which is a missed opportunity with younger users especially. But that wasn’t the only issue.

“The most concerning thing with the bottom 20, in some cases the assessors just were not able to fulfill the purchase,” Kositzke said. “They tried several times, probably more times than a customer would, and it doesn’t go through. ”

Issues in the gift card experience can be costly because it can be a customers’ first impression of a company.

“A gift card often kicks off a customer’s relationship with your brand,” Hirschfield said. “It’s a challenging, but also an amazing opportunity, because many times the gift card leads to additional purchases of both your material items and more gift cards.”

One of the key differentiators for the top performers in the benchmark report was a dedicated gifting section on their website and app.

“All the top-performing brands had a clear path to gift cards,” Spidaliere said. “It was clear what customers needed to do, how to personalize, all the ways they could buy the card. The best-performing brands promoted their cards on multiple places on their site, and marketed their program outside of the website and app.”

Top-tier gift programs used social media and emails to attract new customers. Those merchants  also found innovative ways to offer personalization, like giving buyers the ability to upload a photo or video to accompany the card. Top-ranked programs also connected their gift card programs to their loyalty programs to incentivize gift card purchases.

“The recommendation here is to get creative,” Spidaliere said. “Align your promotions to what’s most important to your brand. The top performers had recipient experiences that were really thoughtful and considered both the recipient and the buyer. What’s meaningful to your customers? For instance, you could consider a partnership with other brands that are important to your customers and produce a co-branded promotion that leverages both audiences.”

The 2024 evaluation offers clear takeaways merchants can use to identify untapped opportunities for their gift card program –

Companies should continuously strive to raise awareness of their program, prioritize creating an optimal customer experience with a mobile-first approach, and consider offering options for gift card personalization.

Integrating loyalty programs with gift card programs is another best practice. Companies should explore opportunities to sell and redeem gift cards across all customer touchpoints.  A great gift card program also requires the ability to detect and prevent fraud `, often requiring a partnership with a third-party expert.

Finally, functionality should be the top priority. Companies should regularly evaluate their gift card programs through the eyes of the customer to ensure seamless processes. This approach not only ensures efficiency but also helps identify opportunities for improvement and ways to differentiate the program. Company websites should include site search keywords that make it easier for customers to find gift cards.

“Gift cards pay off,” Hirschfield said. “It’s an easy and low-cost way to turn someone from a stranger to your business into not only a loyal consumer, but an advocate for your brand.”

Source: 1. BHN EQ Global Spring Gifting Study, n=2,019 US consumers 18+, Feb 2024

Fill out this form to talk to BHN:

Your form has been submitted! A BHN team member will be in contact with you to learn more about your audience, objectives and needs.

Reconciliation is an essential aspect of the accounting process that improves transparency, maximizes decision-making, and ensures regulatory compliance. However, many merchants and payments organizations still rely on inefficient processes that can result in errors, financial losses, or violations.

In a recent PaymentsJournal podcast, Nick Botha, Global Payments Sales Manager at Autorek, and Don Apgar, Director of Merchant Payments at Javelin Strategy & Research, discussed the importance of optimizing the payments reconciliation process and explored the influence of automation on its efficiency.

The reconciliation process is often fragmented among business divisions, which can lead to inaccurate reporting.   

“It should be viewed as an end-to-end process,” Botha said. “That includes financial controls, operational processes, payment flows, the whole of financial operations. Reconciliation has become integral to the success or failure of a middle and back office these days, and it must be a single, continuous process.”

Another pain point is the reliance on legacy-based processes or manual workarounds to process complex financial data. As a business scales, inefficient methods increase the potential for a costly reconciliation error.

“A function of paying money out is reconciling it,” Apgar said. “There’s been so much growth in the fintech space, and so many companies have stepped in that don’t realize how complex it is. They don’t understand the sheer number of data sources there are, the number of categories, and how many feed types to apply.”

The move to faster payments is likely to compound reconciliation challenges. As instant payments rails like FedNow and RTP gain traction, companies will be compelled to adopt reconciliation processes capable of operating in real-time environments.

Mastercard and Visa recently settled with merchants, agreeing to relax certain restrictions and reduce credit card interchange fees. The settlement is expected to save merchants $30 billion over the next three years.

“It’s a splashy headline,” Apgar said. “It boils down to a four-basis-point rate reduction for merchants, which is not much. The big news was the rules changes that allowed large enterprise merchants to negotiate their own interchange fee deals with large issuers. For example, Target could cut a deal with Chase for a lower interchange fee in exchange for ‘We Prefer Chase’ signage at the point of sale.”

The settlement also allows merchants to charge customers more to accept rewards cards that often have higher fees, such as airlines rewards cards.

“It will only be effective if merchant operations are improved,” Botha said. “A large, global merchant that’s still processing manually with spreadsheets and a team of 40 or 50 people, the new rules won’t have much of an impact because they aren’t efficient enough to take advantage of them. They’re using methods that are no longer fit for purpose.”

Though the settlement may provide short-term relief, many merchants and payments companies are operating on thin margins. If volume increases, they’re not prepared to scale accordingly and keep their margins secure.

In the interest of protecting consumers, regulators have established requirements stipulating that clients will receive 100% of their funds back in the event of liquidation by the payment services firm. In addition, the safeguarding regime ensures payment companies aren’t allowed to commingle their operational funds with their clients’ funds.

According to Botha, safeguarding extends beyond individual businesses. Partnerships are critical to the reconciliation process, necessitating collaboration with acquiring and technology partners that share the same values as your business.

Internal and external audits are another critical tool often overlooked by businesses. Regulators are intensifying scrutiny of merchant-bank relationships and payment ecosystems. With regulatory inquiries from the FTC, the CFPB, and the FDIC becoming more common, businesses should conduct self-audits to precisely assess their standing.

“For those companies that are still using legacy processes, creating even a basic report for regulators could be a nightmare,” Apgar said. “Automating the settlement function and having the data organized and accessible is crucial for accurate reporting. It’s not just about organizing your daily functions; it’s about preparing yourself for compliance inquiries so you can respond without manual intervention.”

Internal and external reconciliation are the biggest issues regulators have identified in organizations.

“It’s not just the manual processes,” Botha said. “There’s not enough control around these functions. Businesses must know what their workflows are, how they’re managed, and the tools used, simply to produce accurate reports. Many times, regulators aren’t just looking for data, they’re looking for insights into a company’s operations.”

Many reconciliation issues could be resolved by improving the communications between business segments.

“In today’s world, a data team might be handling day-to-day financial data,” Botha said. “You might have one team dedicated to reconciliation and month-end functions, and then a different team that’s handling stakeholder reporting. Even though there’s all these different business units, it’s one process. Companies must fold all those functions into a single source of truth.”

Every business has its own culture, but gaining an understanding of how competitors or similar organizations operate can provide valuable insights. Companies should also consider macroeconomic factors beyond their own geography, given the increasingly global payments economy.

When a business is fragmented, automation can do more harm than good because it’s based on inaccurate information. However, once a company has centralized its data, automation can have a substantial impact, especially as the company scales.

“Businesses spend so much money on customer acquisition and experience,” Botha said. “I would strongly suggest allocating an effective budget to your technology stack over the next few years. Funds rarely go to the back office, but that’s the piece that ensures you can scale as you acquire customers.”

Apgar added: “At some point you have to step back and build infrastructure. Often, if it’s not visible to the customer today then the money doesn’t get allocated toward it. But those processes will become visible to the customer when they don’t work.”

The United States is a unique banking market, with more than 11,000 financial institutions and some of the most stringent regulations in the world. With the launch of FedNow last year, The Clearing House’s RTP network, and a new messaging standard in ISO 20022, U.S.real-time payments have finally arrived. There’s only one problem: The infrastructure here is not ready. 

In a recent PaymentsJournal podcast, Himanshu Pujara, Managing Director for Euronet Worldwide, and Elisa Tavilla, Director of Debit Payments at Javelin Strategy & Research, spoke about how instant payments are happening around the globe today, and how banks can develop payment platforms that take advantage of increased standardization and interoperability, as regulatory bodies push for a more interconnected financial ecosystem.

The state of global payments varies depending on where you look.

“We’ve connected to many RTP networks and have been processing instant payments for over a decade now,” Pujara said. “In India, the Unified Payments Interface has been a game-changer, enabling billions of transactions monthly with its simple, mobile-driven approach. Then there’s the EU’s SEPA Instant Credit Transfer, which streamlines cross-border payments efficiently within Europe. In Brazil, the Pix system has revolutionized the speed of payments, quickly becoming a mainstay in their financial ecosystem. We process millions of transactions every single month for our customers in the emerging markets, and in all of these markets real-time payments has become a dominant form of payment in the day to day lives of consumers.”

These global trends have not yet matured in the U.S. market. While the United States has had limited access to instant payments in the past, FedNow has sped up the timeline for banks to offer such payments to consumers and merchants. This gives banks the opportunity to enhance transaction efficiency, financial inclusion, and economic growth.  

Although there are different U.S. regulatory and market environments, the future points toward more collaborative efforts to harmonize regulations and technical standards, making it easier to transact instantly and across borders. Financial institutions have the opportunity to use the real-time payment rails to launch innovative use cases for customers such as insurance companies or payroll service providers.

Under the new rails, banking teams could offer a cash management solution or a liquidity management solution to make sure the merchants they support get their funds in real time. In other parts of the world, fintechs have taken the lead by converting their closed-loop stored-value wallet propositions and making them interoperable on the back of real-time payment systems. U.S. fintechs have the same opportunity. 

The challenges lie primarily with legacy applications and their architecture. How does a bank make sure it’s able to connect to these systems in the shortest possible timeframe, knowing there will be new services or functionalities launched by the Fed or TCH? And how do consumers recognize the benefits of adopting instant payments?

“We all know consumers in the U.S. are very card-centric,” Tavilla said. “They like using credit and debit cards and have been accustomed to their rewards and incentives, as well as the purchase protection that cards provide. It’s important for providers to offer comparable benefits to give consumers a reason to convert from card payments to other types of payments.”

U.S. consumers often expect inconveniences in their financial transactions, not realizing that an instant payment system could ease issues.  “Last week I unexpectedly had to go shop for a new car,” Tavilla said. “On Sunday, I picked out a car and negotiated the price. The dealer offered to put $3,000 on my credit card but asked for the balance by the day after tomorrow, which was a Tuesday.  I don’t keep tens of thousands of dollars in my checking account, so I had to transfer it from my savings account via ACH, from one financial institution to another.” 

Such transactions can take a few days to transfer and cost the consumer $30 or $40 each. Real-time payments and ISO messaging can help alleviate such pain points by automating and reducing the time and heightening the efficiency of the entire process.

“Elisa’s story is a classic example where the customer would want some sort of a payment rail, where the money can move on a real-time basis,” Pujara said. “She had an urgent requirement, but even on an ordinary basis, we’re all used to instant gratification. Whether it’s ordering a ride or shopping for goods, the real time element is there pretty much in every part of our lives, other than money movement.”

U.S. financial institutions have decisions to make as they move into instant payments. In addition to having connectivity to RTP systems, banks can build an orchestration layer on top to decide on the rules they want to put in. They have the flexibility to scale their processes based on cost, availability, or which network to route the transaction.

To navigate and capitalize on the evolving landscape of instant payments, organizations must be technologically adaptable, savvy with regulations, and customer-centric, ensuring they can meet the demands of a rapidly changing global payments environment. This means investing in payment technologies that can quickly conform to new standards and regulations. Cloud optimization is just one example of innovative technology that can enhance performance, security, and cost-efficiency.

The future points toward increased standardization and interoperability, as organizations and regulatory bodies push for a more interconnected financial ecosystem, enabling seamless transactions and enhanced user experiences globally. We’re likely to see more collaborative efforts to harmonize regulations and technical standards, making it easier to transact across borders. 

As those efforts come to fruition, Euronet offers an example of the flexibility available to U.S. banks. “We have a flexible deployment architecture depending on the size of the financial institution,” Pujara said. “We could provide a license that the bank can deploy in their own data center. For some of the smaller banks, we have a fully managed services offering with a hosted solution, which includes not just processing these transactions, and routing the transactions to instant payment schemes. It also includes services like reconciliation, settlement, unified dispute resolution, fraud, and risk monitoring.” 

The end-of-the-year flurry of holiday shopping is a classic example of business seasonality. As fraud professionals have long observed, fraud activity also follows seasonal patterns, with seasonal upticks and slow-downs. The challenge has been reacting to seasonality with precision in real-time, instead of just recognizing them in the rear-view mirror. And new data shows that this seasonality doesn’t correlate to the business year as much as one might expect—fraudsters have a seasonal calendar all their own

In a recent PaymentsJournal podcast, NeuroID Head of Operational Strategy Nash Ali and Tracy Kitten, Director of Fraud & Security at Javelin Strategy & Research, discussed the seasonality of fraud. They analyzed the methods criminals use and offered solutions to keep businesses safe.

Fraud attempts are rising overall, up 57% from 2022 to 2023. Due to the holiday frenzy, December might seem like the logical peak of fraudulent activity.

“In fact, it’s January,” Ali said. “January has a 78% higher fraud attack rate than the average monthly rate. That includes a 59% increase in application fraud, where criminals falsify data or misrepresent themselves to business owners. There’s also an 85% increase in the hours businesses are under attack in January compared to the rest of the year.”

After a February slowdown, there’s a 44% higher fraud attack rate in March compared with the typical monthly average. A higher portion of March attacks consists of identity fraud, identity theft, or creating synthetic identities with bots and scripts. After another lull in April, fraud picks back up in May.

“We see 50% more application fraud in May compared to monthly averages,” Ali said. “A lot of that fraud is concentrated fraud attacks committed via fraud rings. After a slow summer, fraud rates pick back up in the fall, peaking again in October.”

Criminals are constantly looking for weaknesses, and seasonal fraud trends are no doubt spurred by company vulnerabilities. Business owners should also understand that there can be a delay between when their business is breached and when fraud actually occurs.

“Company information is likely being compromised during these high-usage months, like the holidays,” Kitten said. “Then we don’t start to see the fraud until several weeks to a couple of months later. When does a compromise happen and when does the actual fraud result?”

In the drive for year-end sales, companies often open themselves up to fraud attacks.  

“They’ve relaxed controls, they’ve let their guard down in order to attract more volume,” Ali said. “They also staff additional people to meet the additional volume. In January, businesses are scaling down their workforce and there are less eyes on fraud.”

The spike in March may also be attributed to the end-of-the-year rush. It takes time for data obtained from end-year breaches to circulate to the bad actors who exploit it.

“By March, it’s made its way through the trenches of the dark web and into the hands of fraudsters who will actually do something with it,” Ali said. “That’s why we see more identity theft, identity fraud in March.”  

Data breaches are increasing in frequency, to the point that it’s no longer shocking. That trend is likely to continue.

“Breaches don’t raise flags anymore,” Kitten said. “But there are still things companies and security teams should continually look for, including on the dark web. They must keep searching for indicators that a larger breach has occurred and company information has been compromised.”

The high-tech means criminals have at their disposal, especially since the advent of AI, increase the difficulty of preventing attacks. Cybercriminals have sophisticated ways of creating forged documents, like passports and driver’s licenses. Businesses that rely on document-based verification will likely see fraudulent documents that are difficult to detect, even with physical biometrics.

The May fraud spike is also a reaction to a time when businesses are vulnerable.

“The first quarter of the year tends to be a time when many companies release new products, new offerings,” Ali said. “In the financial services world, they release new loans. Fraudsters home in on that, which is why we see a resurgence of fraud in May. New products tend to have lower controls as they’re rushed to market, so in May criminals are looking to exploit that.”

Criminals often spend a lot of time conducting probing attacks. Criminals will explore perimeters, controls, and boundaries to measure a company’s effectiveness at identifying and preventing fraud.

“They’re testing companies to see what they can get away with,” Ali said. “Probing attacks are these short bursts of fraud activity, and most institutions don’t even react. If they do detect it, often they’ll ignore it because they’re looking for larger-scale fraud. When the real attack comes, they won’t realize it until it’s too late, because fraudsters found vulnerabilities through probing.”

The holidays are a common time for probing attacks, when thresholds are down and companies provide customer incentives and promotional products. That’s why it’s crucial for businesses to place a special emphasis on fraud prevention at the end of the year and install systems that will be attuned to detecting probing attacks.

New technology has made it increasingly difficult to detect fraud, because bots can be programmed to perform probing attacks. They can create new identities or attempt entry through permutations of personal data.

“It’s important to have tools that can detect whether an attack is an automated script or a human,” Ali said. “Businesses need proactive, real-time, technology-based solutions. You can’t rely on humans doing manual reviews. It’s not scalable, especially at the holidays. If you do install automated tools, however, they must be fine-tuned to lower false-positive rates.”

Often, businesses go too far and use outdated methods that end up placing undue friction on consumers.

“Enterprise fraud mitigation solutions have to equally evolve with fraud, if not be ahead of the game, especially since AI has been used in fraud attacks,” Ali said. “The best way to be prepared is not to rely on the same legacy fraud mitigation solutions to try to solve new fraud attack vectors. Behavioral analytics complements traditional fraud tools, and you can passively detect fraud.”

A combination of behavioral analytics, technology, and skilled oversight is the most potent defense. To that end, NeuroID offers an array of fraud detection and prevention solutions that harness the power of behavioral analytics.

“It has to be a multilayered approach,” Kitten said. “As things continue to evolve, the amount of friction on the customer is also a critical consideration. It’s increasingly important to do whatever can be done on the back end to authenticate and verify the authenticity of a user in a transaction. That’s where behavioral analytics come into play.”

Now that the Payment Card Industry Data Security Standard 4.0 has gone into effect, merchants have a year to conform to the 63 new or updated requirements. With many moving parts to the standard, some businesses may struggle to understand their compliance obligations. Simultaneously, they also don’t want to risk creating friction in the customer experience as they introduce the new security measures.

In a recent PaymentsJournal podcast, Sukanya Madhavan, Payments Chief Product and Technology Officer, at CSG Forte and Don Apgar, Director of Merchants Payment Practice for Javelin Strategy & Research, discussed the new rules. They examined the implications of the change and mapped out steps business owners can take to ease the shift to the new standard.

One of the main things to know about PCI compliance is that it’s an evergreen and ongoing process. The purpose of the compliance program is to build a safety net for consumers to make sure they’re protected against bad actors. It also streamlines merchants’ card payments operations.

“The program is designed to ensure that customers have peace of mind when they provide their data to us,” Madhavan said. “It should be considered a continuous improvement process, where businesses look for innovative ways to solve the evolving challenges.”

In response to ongoing data breaches, the PCI standard mandates that merchants conduct quarterly internal and external vulnerability scans. Due to the sophisticated technology involved, it’s critical to have an individual who is well-versed in the systems to review these scans.

If merchants need help, quality security assessors (QSAs) and payments processors can give guidance. Often, the issues turn out to be basic security vulnerabilities involving passwords, such as password sharing or passwords that aren’t strong enough. There is help, however, if the issue is more complex.

“Merchants should know they can reach out to their processors, and there is a whole network of support,” Madhavan said. “It’s a partnership between the processor and the merchant to ensure that they are jointly taking care of the consumers’ data. Some processors have gone so far as to create instructional webinars, and there’s even a hotline.”

Maintaining PCI compliance isn’t just about protecting customers. It’s also about safeguarding businesses. When there’s a substantial PCI violation or a significant data breach, it’s often newsworthy. But it’s not the kind of publicity businesses want.

“With the sheer volume of data and the high profile of many companies, it’s a reputational risk,” Madhavan said. “The consumer data that companies store is there to fuel business growth, and it’s a critical part of doing business. [The costs of switching brands] have decreased so much these days that you must ensure your customers trust you to take care of their data.”

“Many merchants view the PCI compliance requirement as a burden,” Apgar said. “They’re just looking to check a box. They don’t understand that this is a great opportunity for them to take a step back and review where data is being stored, what its uses are, and what rules govern it. PCI is not there to be burdensome to businesses. Keeping cardholder data secure should be viewed as a benefit.”

Merchants that take card payments can already start the switch to DSS 4.0, but there’s still a one-year period before all companies must be compliant. Although some of the new requirements are process enhancements, others are technology-driven. For example, multifactor authentication and passwords with a minimum of 12 characters are now required.

Depending on the business, that switch could take time and affect customers.

As Apgar noted, “Merchants are hesitant to implement some of these things because they don’t want their customer experience to have more friction than their competitors. But if they’re able to introduce new security capabilities, even if the authentication requirements may be more cumbersome, the benefits will offset the drawbacks.”

One of those benefits is added protection from fraud. The advent of newer technology, including generative artificial intelligence, brings a new set of challenges as well.

“It can be a lot for merchants to consume,” Madhavan said. “Should I focus on running my business? Should I focus more on the technology and the security side? It’s important for us as solution providers to make it easier for businesses to operate because they have all these other tasks to perform. We need to support them so they can focus on the core business.”

Security practices are continually evolving to combat new threats. That means companies should be prepared to evolve with those practices, even after they reach compliance with PCI DSS 4.0.

“There’s no magic bullet when it comes to the security side of it,” Madhavan said. “And it takes a village. It takes all of us working together to make sure that the systems are secure. If you don’t know what works for you, there are providers and approved QSAs who can help you. You can also take ownership by continuing to review security best practices and conducting vulnerability scans.”

Another key takeaway is that even though there’s a grace period, merchants should start to work on their gaps to comply with DSS 4.0 as soon as possible. A requirement for more secure passwords, for instance, works only if all of a company’s customers have updated their passwords.

“All these things have to be mapped out; otherwise, you risk a really poor customer experience,” Apgar said. “A year may sound like a long time, but when you start to map out the items that need to be completed and all the moving parts, it’s not so long, after all.”

Learn 3 quick tips to keep your payments data secure in CSG Forte’s white paper.

Though most people still refer to prepaid products as gift cards, that term has almost become a misnomer in today’s payments industry. Prepaid cards do so much more than carry gifts—not just for consumers but also for issuers. Savvy businesses use them to drive more consumer spending while increasing brand loyalty. 

To that end, Fiserv recently worked with Javelin Strategy & Research on a survey of more than 500 buyers in the incentives area to find out what’s driving their purposes. The survey provided a jumping-off point for a recent PaymentsJournal podcast with Tom Niedbalski, Vice President, Global Sales and Partnerships at Fiserv, and Jordan Hirschfield, Director of Prepaid Advisory Services with Javelin Strategy & Research.

The survey was conducted from the buyer’s perspective rather than that of the consumer. Javelin spoke with individuals who are buying incentives for purchasers of their brands, spanning a wide variety of companies, each with revenue of $20 million or more. Their responses provided an incisive look at what the benefits these buyers are seeking in an incentive. 

Javelin’s research has shown that loyalty programs and rebates are highly beneficial for building long-term relationships. This can have a significant impact on customer retention but can also improve the efficiency of onboarding new customers as well.  

“It’s expensive to acquire a new customer, but these incentives had a very material impact on lowering acquisition costs and subsequently on improving customer retention,” Hirschfield said. “With so many useful benefits of offering an incentive to a consumer, you can have a material impact on your bottom line.” 

Despite a reliance on physical gift cards, the shift to digital formats is going strong, consumers by and large prefer digital, and the research shows that the balance is continuing to shift that way.  On the buyer side, people are still purchasing incentives by going to physical stores and buying hundreds of gift cards. They don’t seem to realize they could be doing this through a relationship with a provider in an easier distribution model that can save on costs. 

On the consumer side as well, retail purchases remain popular. There’s an opportunity here to bring in a provider and transition those purchases to a digital distribution method. That can be easier for the buyer and can foster a positive ongoing relationship with consumers or employees. It tells the employee “we value you.” 

“Many buyers do not realize that there can be an economic benefit to buy through an aggregator, or through a brand’s website,” Niedbalski said. “In many cases, they will not only get a discount for that purchase but also build a strategic relationship with the brand, where there could be additional cobranded opportunities and synergies for the two companies to leverage.” 

According to the research, 40% of consumers will receive some sort of incentive this year. 

“When we look on the buyer side for the B2B side of the equation as opposed to the B2C side, that’s where the digital’s coming in,” Hirschfield said. “On the buyer side, 60% of purchases are digital, which makes sense, because around 70% of the recipients prefer that.” 

But the survey found that 39% of buyers are still giving out physical cards, even though 46% of them preferred digital. On the consumer side, the individual will control that relationship. 

Niedbalski noted that Fiserv is seeing use cases evolve because digital enables integration into various distribution vehicles. “Brands are now using this platform not only for loyalty but for rebates, for warranties, for specific product couponing, and for customer appeasement,” he said. “And of course you’ve got the foundation of a giftable program as well, where the card just remains a gift.”

Everything seems to be moving to a digital format, whether it’s credit cards, library cards, gift cards, or loyalty cards. Wallets, like George Costanza’s in the famous Seinfeld episode, have gotten too stretched to carry around those cards in a physical format. 

“But even our digital wallets are also starting to get overcrowded in some sense,” Niedbalski said. “With Google Wallet and Apple Wallet, we’re seeing a lot more brands invest in their own vaulting solutions. They’re creating branded apps to drive consumer engagement. The convergence of all their payments along with their loyalty programs into a branded wallet could prove to be a pivotal point for adoption of digital both at the consumer level as well as the merchant level.”

Since the pandemic, brands have reprioritized their consumer engagement model. Although they still want foot traffic in their stores, they’re seeing a lot more traffic outside of their stores, whether it’s via curbside drive-through, delivery, or online shopping. How do you maintain personal engagement with a consumer virtually? 

Many brands are dealing with this by bringing the in-store experience into a mobile environment. “They need to provide enough value within their app to keep the customer clicking that icon on their mobile phone,” Niedbalski said. “A lot of these use cases are being integrated in a way that makes it easy for brands to connect with their buyers and with their consumers.  Along the way, it’s driving convenience and value.”

A virtual card has another value over a physical card: It is easier to use, even in impromptu shopping situations. “I’ve got a stack of probably 20 to 30 gift cards sitting at home on my on my office desk,” Niedbalski said. “Some of those gift cards are 20 years old and still have value on them. I’ve never redeemed them because I’ve got too many cards. I can’t carry these around with me every day. With digital, you are able to access your gift cards on demand anywhere, anytime, which helps drive that redemption of those gift cards.”

In modern society, our phones are always with us, which means that our digital wallets are always with us. For many people, their phone is their wallet. “Last week I was traveling, and when I got to the airport, I realized I forgot my wallet at home,” Niedbalski said. “I had no credit cards, no driver’s license, and I’m already trying to figure out how to get through airport security without an ID. Luckily, I was able to pull up my driver’s license through the DMV app for California. I was able to pay for my hotel and my meals using my Apple wallet and the credit cards that I had stored in there. Airline tickets, hotel reservations, loyalty programs, everything I needed was there. I would panic more not having my phone than not having my wallet.”

The banking industry infamously divides itself into silos to address different aspects of the business, which can be problematic for customers who think they are dealing with a single entity. This can be especially difficult during onboarding and security checks, when different silos at the bank ask repeatedly for credentials.

In a recent PaymentsJournal podcast, Sunil Madhu, founder and CEO of Instnt, a fraud loss indemnification that covers the entire customer lifecycle, and Jennifer Pitt, Senior Analyst of Fraud and Security at Javelin Strategy & Research, discussed the challenges of providing an easy, frictionless process for consumers while still safeguarding their privacy.

Retail banks have separate organizational units handling checking accounts, savings accounts, loans, and mortgages. Each of these silos has its own requirements for risk and compliance, comprising a half-dozen or more tools, that are used to vet individuals who are signing up for a particular product or service. Each has its own know-your-customer (KYC) protocols for compliance purposes.

The consequence of this is that anyone who signs up for a checking account has to go through a whole series of checks pertaining to KYC and other types of fraud. If that person comes back six weeks later and applies for a loan, they may have to provide the same information again, even though they have a relationship with the bank.

Obviously, different products have different types of risk, which is one of the reasons for these operational silos. But customers don’t care about that. They perceive themselves as working with a single bank, whether they’re dealing with a mortgage or a small-business loan or a checking account.

So there are advantages to connecting the silos with the technology that allows each line of business to have its own the independent risk and compliance management requirements. That can give the bank’s divisions the flexibility they need to maintain independent control while simplifying the user experience by giving customers a reusable, verifiable credential.

“We get a lot of reports that consumers are not happy with onboarding processes,” Pitt said. “They always say, ‘I thought I already gave you my information. Why do I keep having to give you this information?’ Having one place where that information is kept on the consumer’s device, and the consumer can dictate how they give that information. Not only can this help the consumer, but it can also save time for businesses as they onboard people.”

Businesses can frictionlessly sell multiple products and services without repeated signups that can leave customers frustrated. It’s time to rethink this kind of infrastructure so that it focuses on less friction for the user and easier onboarding experiences.

The past few years have seen new compliance standards, including verifiable credentials and decentralized ID, based on the notion of the blockchain. These two technologies combined have enabled businesses to issue reusable passes to customers who sign up.

“If I were to open up a checking account,” Madhu said, “I might get a pass back, which essentially is a tokenized identity document that helps to identify who I am. It also contains assurances from the verifying authority that issued the document, that the information has been vetted and verified. There’s also a KYC verification component to it.”

From a compliance perspective, the presenter of that pass has passed the necessary KYC checks and any other standard that needs to be met. The decentralized ID protocol helps prove the ownership of the document so the recipient can verify that the data belongs to the user. No one else could have stolen the pass or modified its contents.

These two technologies enable a user to get a comprehensive pass when a checking account is opened. When the user logs back into their checking account, they can present the pass again as the authentication token in lieu of a password. When they want to access other products or services, they don’t have to go through a whole other signup; they simply re-present the pass. As long as the level of assurance of the issued pass matches the requirement of the product or service the user is trying to access, they’ll get one-click access into the system.

“The new technology is as strong as multifactor authentication, but unlike other technologies like pass phrases and pass keys and multifactor authentication itself, it’s fully decentralized,” Madhu said. “There is no central point of attack for a hacker to compromise the database and steal the data and authenticating tokens. All of that risk goes away because the technology ensures that the credential is in possession of the end user, securely vaulted into their mobile devices with very mature mechanisms that essentially cancel a pass from a device that might have been lost or stolen.”

The technology is omnichannel, meaning that the person can be authenticated and vetted consistently whether calling into a call center or accessing the application through the web. If someone tries to use social engineering to get the call center to provide them with something like push notifications, the technology essentially thwarts all of those attack vectors.

Instnt has combined verifiable credentials and decentralized ID in a new product called Multipass.

“We provide a toolkit that basically allows the Multipass issuance and verification capabilities to be embedded in your application and provides secure mobile vault for any passes that have been issued to the user,” Madhu said. “All you need to do is load this toolkit into your application, and you have the full capabilities when the user is first registered and onboarded. At the end of the journey, the user will be asked if they wish to receive and store the pass.

“Behind the scenes, the system issues the pass with the data that was collected from the user that went through identity verification, fraud checks, KYC checks, and whatnot. Any additional information, such as the user’s bank account or other information the financial institution might need later on, can also be packaged up into the pass. The pass is then signed with two sets of keys, one that belongs to the user receiving the pass and the other issued from the business conducting the verification.”

The pass itself contains all the necessary information to non-repudiate the pass and verify that it’s not been altered.

“We essentially match the public record of the public keys of the key pairs that were used for the signature and the encryption of the data in the past,” Madhu said. “By virtue of the blockchain being immutable, you get the assurance that this pass was in fact issued to Sunil, for example, by Acme Bank or whomever issued it, and that all of the data in there was verified by Instnt. That assurance is intrinsically built in using the verifiable credentials document and the DID protocol.”

Financial institutions no longer have to store such data in their database, which removes the liability of being hacked. They’re protected from the possibility of consumer data being stolen. From users’ perspective, they’ve simply clicked a consent request saying, “Yes, I want to share the pass.” That’s the only friction they’ll have to face, but their privacy is maintained, and their data is safe.

“Privacy is a very important issue for consumers,” Pitt said. “We found that consumers will actually cancel their bank accounts if their privacy concerns are not met. Giving back control to the consumer about what can be done with their data, how their data can be used when it’s deleted, essentially, is a great thing.”

That type of comprehensive solution is possible only if banks break down those silos. Customers want to work with a single bank. Those banks should take care not to put obstacles in their way—and give them an incentive to seek another provider.

As awareness of the dangers of identity theft grows, it’s important to highlight a particularly insidious threat: stealing children’s identities. Although children have very limited financial activity, this ironically makes them appealing targets for fraudsters.   

According to Javelin Strategy & Research, 1.7 million children had their personal information stolen in 2021-2022, resulting in nearly $1 billion in identity fraud loss. In a recent PaymentsJournal podcast, Tracy Kitten, Director of Fraud and Security at Javelin, explained what makes children so vulnerable to identity theft and what parents and guardians can do to protect them.

Obtaining a child’s personal information is alarmingly straightforward. When a criminal gets a child’s Social Security number, along with their physical mailing address and/or date of birth, that criminal possesses enough information to commit various forms of fraud, such as fraudulently opening bank accounts or applying for loans using the child’s information. 

The COVID-19 pandemic exacerbated risks to children’s identities. Government recovery programs, in particular, saw a fair amount of stimulus-related fraud. Additionally, the increase in online transactions revealed authentication gaps that were challenging to address. While strides have been made to close some of those gaps over the past year, vulnerabilities still exist. 

What’s tempting about using children’s identities is that they have no complicated background to deal with. “These kids don’t have bad credit,” Kitten said. “They don’t have any credit at all; so any type of account could be opened with a clean slate, maybe even a job application for someone who is here illegally.

What’s more, parents don’t readily detect this type of fraud. Since children aren’t applying for credit cards or mortgage loans, identity theft is not noticed until the child has reached maturity. 

For many of us, our Social Security numbers, along with our email addresses and passwords, are floating around the dark web. We’ve become more adept at handling breached information and are increasingly mindful about the information we share about ourselves online. However, all it takes is one slip—such as the exposure of your Social security number—to cause significant and long-term challenges.  

“We like to think that the government is this well-oiled machine that knows everything,” Kitten said. “The reality, however, is that our information is everywhere, and we don’t have good checks and balances in place to detect and determine  where it goes.

“You would hope that if someone were to steal my Social Security number, there would be a red flag raised somewhere, maybe at the Social Security Administration, to say, ‘Wait a minute, Tracy Kitten actually uses this Social Security number, but she doesn’t have this same date of birth, and she doesn’t have this same mailing address.’ But that’s not the case. That is why, oftentimes, you see identity theft that ultimately results in fraud taking place and going undetected for years and years.” 

This problem is worse for children, because they aren’t actively managing and monitoring their personal information regularly. When a child’s data is breached, there is no system in place to immediately notify parents. Frequently, parents and guardians only discover such identity compromises when applying for a student loan or when their child seeks first-time employment. Sometimes, the realization doesn’t occur until the child attempts to buy a car or rent an apartment.

“We strongly recommend that financial institutions step in to provide assistance, even though they aren’t necessarily going to be the entity that will resolve all of this,” Kitten said. “At the very least, financial institutions can step in and give guidance, and assist their customers and their members.”

Without such oversight from their financial institutions, parents and guardinas should take proactive steps to safeguard themselves and their children. Kitten recommends several steps :

Finally, it’s important to highlight the emotional toll identity theft takes on the entire family. Beyond the financial implications, the thought of your child’s information circulating among cybercriminals and scammers can be overwhelming. The gravity of these concerns should motivate parents and guardians to take proactive measures to protect their children’s identities.

“If they know enough about my child to open up all these accounts, what else could do?” Kitten asked. “Not only does it take an emotional toll; it wreaks havoc with us psychologically. Are we physically safe? Are our children physically safe?” 

Even though the number of checks written continues to decline, mail theft remains on the rise. Beyond the theft of checks directly from mailboxes, there have been instances of stolen mail trucks. The ease of modifying checks allows criminals to simply wash and modify the payee’s name. 

Q2’s positive pay system, used by roughly 550 banks across the country, is on track to stop more than $2.5 billion in fraud this year. In a recent PaymentsJournal podcast, Bruce Dragoo, Manager, Solutions Consultant for Q2, and John Byl, SVP Product Development at Mercantile Bank of Michigan—a Q2 customer—discussed how to get people on board to combat check fraud with Albert Bodine, Director, Commercial and Enterprise Payments for Javelin Strategy & Research.

In 2022, around $720 million of fraud was identified and stopped by Q2’s positive pay system. Last year, that number doubled to $1.4 billion.

“It seems like it’s wider-reaching at this point and coming downstream to smaller businesses,” Byl said. “It had been historically viewed as a large corporate need, but it’s indiscriminate at this point—and it’s affecting everybody.”

A third of commercial payments globally are still made by check, which presents a huge opportunity for criminals. But only 30% of eligible businesses use positive pay, which matches the details on a check to the details on file with the bank to ensure its validity. Some related solutions cover just checks, and others cover ACH transactions, but they don’t address the gamut of everything a business may need.

“In some cases, having a great technology provider that can provide not only check but ACH positive pay, along with full reconcilement capabilities, can be a barrier to some of these institutions signing up for a full breadth of what they need,” Dragoo said. “It’s about being either reactive or proactive in regards to the financial institution selling positive pay. At some financial institutions what I’ll hear is that the only time that they sell positive pay to a customer is when they’ve had check fraud on their account and they’re reacting to the situation.”

Talking to customers before they open a checking account can be critical. If they are a small business or a corporate client, financial institutions can say, “We have a great solution for you that can help identify and stop check fraud before it even happens.”

The best value proposition for positive pay is stemming or eliminating the flow of funds out the door to fraud.

“We’ve gone through the evolution of being reactive and only bringing up positive pay when we’ve had check fraud or a customer’s asking about it,” Byl said. “What we’ve realized with this whole process is that many customers are not aware of what positive pay is, or why they might need or want it. We need to create awareness for our customers and help them understand how they go about implementing something along these lines.

“I’ve worked for institutions where we haven’t had a great solution in place, one that hasn’t been very user-friendly to work with. Thankfully, we have a solution today that is user-friendly and adaptive to our customers, so we can remove those barriers to entry for them and make it as an easier process as possible.”

Some financial institutions are limited in how they can build out new revenue streams. Many of their resources go into supporting legacy systems. Having organization partners enables FIs to bolster the security of the products and services they offer.

“While 30% of the institutions we’ve surveyed are not charging for positive pay, of those customers that use it, 47% of them said they would pay for positive pay,” Dragoo said. “They understand the value of the solution itself in helping to stop any type of fraud that may be coming through their checking account. Several of our financial institutions actually have turned their treasury management team into a revenue generator just by selling positive pay at a nominal fee of $30 to $50 an account.”

Customers respond best to thinking of positive pay as a form of insurance against fraud. Q2’s approach has been not to nickel-and-dime their customers for each little tick mark that happens as part of the positive pay process but rather casting at it as a holistic product that can protect customers.

“It’s easy to build revenue models for positive pay, taking into account the mitigation of the fraud losses,” Bodine said. “Even if you’re partnering with somebody from the outside, it’s pretty easy to cover those transactional costs by eliminating those fraud dollars that are going out the door.”

Financial institutions can’t assume their customer base knows or understands what positive pay is and how it can protect them. Q2 has identified some essential items that financial institutions can use to increase the adoption of a good positive pay solution. Rolling out a solution that has check and ACH positive pay in it—and has great pay-name match reporting self-service for the customer—is a good first step.

Secondly, financial institutions should sell positive pay proactively by talking to customers at account opening. They should educate them on check fraud and what it looks like. Although some consumers may not have encountered fraud yet, they will understand the risks, especially when they hear a broader value proposition.

“Part of what where our successes come from has just been in helping our staff understand who our customers are and what sorts of fraud scenarios we’re seeing taking place in the market area,” Byl said. “We make it more real to people—this isn’t something that’s happening on one of the coasts. It’s happening around the corner where a mail truck has been robbed. Or these people dropped stuff in their mailbox and put the flag up and just walked away and didn’t realize people would have the audacity to just take that stuff out of there.”

Partnering with a dedicated provider is vital. “One of the strongest recommendations that we’re making at Javelin in the commercial enterprise practice area is that legacy bank structures are not really set up to do well moving forward,” Bodine said.

Q2 is looking at enhancing its pay-name match to make it even better. The company is also looking at embedding AI technology into the solution to help not only FI customers but also frontline bank staffers to sell positive pay to existing customers and prospects.

“As a Q2 customer, the biggest thing is having a partner who is willing to listen to you and engage in the conversation,” Byl said. “They listen to the feedback of their customers and make their product better. That’s been huge to know not just what’s happening in your neck of the woods, but how other FIs that they work with are implementing their best practices. Having that collective learning going on makes such a huge difference.”

Said Dragoo: “You’re the one that’s bringing us the ideas and bringing us what is happening in the market that we may not be seeing. We appreciate that partnership so that we can develop leading technology and make sure that we can help identify and stop fraud in the future.”