Digital Transactions Authoritative, insightful and timely information for payments professionals
The news that the major payment card networks will implement a standardized buy button later this year may have stirred hopes among issuers, merchants, and acquirers that the longstanding problems of rising e-commerce fraud and inconsistent checkout flows will finally be addressed. But already cautionary notes are emerging to indicate the bulk of the hoped-for benefits could be years away.
Version 1.0 of the Secure Remote Commerce specification from EMVCo, the major card networks’ standards body, emerged Friday, and almost immediately American Express Co., Discover Financial, Mastercard Inc., and Visa Inc. said they plan to incorporate the SRC process within a matter of months.
The new blueprint promises to streamline online checkouts for transactions involving the major card brands. It is also expected to cut fraud by incorporating reliance on such technologies as device ID, tokenization, and 3-D Secure 2.0, a separate security standard from EMVCo. Fraud losses have become a big headache for card issuers and online merchants in the United States, rising 38% last year to $4.4 billion, according to numbers compiled by Aite Group, a Boston-based financial-services research firm. Unchecked, losses will total $6.4 billion by 2021, double the total in 2015, Aite projects.
“With thousands of merchants approaching digital commerce with different approaches, opportunities for fraudsters to crack a merchant’s platform are significant. And while many merchants maintain high levels of security around their payment processes, others don’t, and inconsistency is the enemy of security,” notes a report just released by Aite.
But implementing the new SRC standard will be a complicated business, leading observers to warn the payments industry not to look for any quick payoffs. To begin with, implementation is voluntary, and some merchant advocates have already said they doubt large online retailers, which have already invested in smoother and more secure checkouts for their sites and apps, will want to adopt it. “Even if SRC becomes a common solution, it will take some time to impact the total digital-commerce ecosystem,” cautions the Aite report’s author, senior analyst Thad Peterson.
Also, the standard does not contemplate systems built outside the constellation of the major card brands. “The limitation of SRC is that it is completely payment-network-card based. Alternative payment schemes such as Alipay or even PayPal will be precluded from using the capability,” says the report, “SRC and the W3C Payment Initiative: Revolution in Online Retail?” W3C refers to the Worldwide Web Consortium, a standards body for the Internet that has been working on its own spec for payment flows.
Once built, the buy button will face yet another problem: enrollment. Branded checkout systems from the card networks and big tech companies like Apple Inc. have all struggled to attract users, Aite’s report says. “There are few examples of past programs that have succeeded in enrolling enough customers to achieve critical mass,” notes Peterson in the report. “The only success stories have been wallets that were embedded in the payment stream, like PayPal and Amazon Pay.”
But while it may be long in coming, the payoff could be significant, Peterson adds. “If implemented as envisioned, SRC will create a secure payment process in which the merchant has no need to retain customer [data] unless it so desires,” the report says.
