Coloque aquí el Título de su Tema a exponer

Digital Payments Solutions
security, maturity and user convenience
Stéphane Fabre,
Gemalto México
1
Agenda
•
Digital payment ecosystem: models, technologies, stakeholders
•
Payment Credentials: in tamper-proof devices, in the software host, in
the cloud
•
Payment methods comparison in terms of security, solution maturity,
convenience and customer reach
Main objective: assessment of the different methods in digital payment in
terms of security, solution maturity and user convenience
Digital payment ecosystem
Online and in-store
4 ways to complete a payment
S/W, NFC, SIM, SE
TEE, QR, BLE, HCE,
TSM, TSP, OTP
SMS, USSD
Multiple technologies
to coexist
Mobile payment services launched
or at pilot phase worldwide
Users expect a payment service to come with
Security: Keeping money protected
from fraudsters
Rewards: The benefit
Simplicity: Providing a seamless
enrollment and making the
daily use of the payment solution simple
of using a payment solution
Reliability: Making sure
that the payment service works every day
Services: The benefits beyond payments
(shopping experience prior and after payment)
Payment solutions are evaluated based on
User adoption: A simple customer
journey, both for enrollment and day to day usage
Liabilities: Mitigating the risks
Value-add: Differentiated services
from competition
Brand impact: A digital payment
expansion of the core business
Go-to-market path: The deployment to
deliver the services to the target users
Online and In-Store Digital Payment
CARD NOT-PRESENT
PAN/exp date/CVV
CNP Token
NFC
Login/PWD with registered card
+ Out of band security (OTP)
Biometrics
QR
WIFI
BT
Key architectural elements
****
*** *
Host or
+
TEE
END-USER
EMV
STICKER
COMMUNICATION
LAYERS
BACK-END
Payment Credentials Storage
In tamper-proof devices
In the software host
In the cloud
Payment Credentials in tamper-proof devices
****
EMV Cards (*)
or
Tokens as digital payment credentials (**)
+
TEE
(*) EMV cards/Proxy cards issued and stored at the Financial Institution
(**) Tokens generated by Token Servive Providers with funding PANs kept in a HSM
C
Payment Credentials in the software host
****
Tokens as digital EMV credentials
Payment Credentials stored in the cloud
****
Online access to payment credentials (stored in the cloud)
Cloud
PAYMENT METHODS COMPARISON
Security
Solution maturity
Convenience
Customer reach
In-Store
Online
Security threats
Payment method
Types of attacks
Target
PAN/exp date/CVV
Malware
Device
Login/pwd (registered cards)
Phishing for login/pwd
PAN/credentials databases
Device
Network
Login/pwd + OTP
Malwares (App specific)
Device
P2P
Phishing for login/pwd
Device
Mobile NFC
Mobile phone & PIN theft
Device
Mobile QR
Malware
Device
Network
EMV Card
Card and PIN theft
Card
Magnetic Stripe Card
Skimming/credential database
Card
Database
Payment credential in
tamper-proof devices
EXAMPLE: ANY SE BASED (SIM or eSE such as APPLE PAY)
Security level
Addressing
handsets
diversity
Addressing
network
diversity
Solution
maturity
User
convenience
Payment credentials in TEE
EXAMPLE: SAMSUNG
Security level
Addressing
handsets
diversity
Addressing
network
diversity
Solution
maturity
User
convenience
Payment credentials in the cloud
EXAMPLE: AMAZON.COM
Payment credentials in the software host
EXAMPLE: Google Wallet
Security level
Addressing
handsets
diversity
Addressing
network
diversity
Solution
maturity
User
convenience
Security level
When compared
Addressing
handsets
diversity
Addressing
Network
diversity
Benefits for Banks
capitalize on MNO’s customer
service (in case of SIM)
in the SE
Solution maturity
User convenience
address network diversity
in the TEE
Ownership of their SEs
Benefits for MNOs and Handset Makers
in the cloud
in the software host
Takeaways
Multiple payment
methods will coexist
It’s not only about security
It’s also about convenience, brand
impact and deployment feasibility
Large scale deployments
today rely on field-proven
technology