Mobile Payments – The Evolving Legal Landscape
June 12, 2012
Index
I.
Overview
A.
Mobile Payments and their Regulations
B.
Traditional Payments
C.
Mobile Payments
D.
Regulation of Mobile Transactions
E.
Mobile Statistics
F.
Barriers to Adoption of Mobile Payments
G.
Government Action on Mobile Payments
II.
Concerns
A.
Traditional Payments Fraud
B.
Security Considerations
C.
Privacy
D.
Consumer Protection
III.
Law and Regulation
A.
U.S. Legal Landscape
B.
Regulators
C.
Questions for Regulators
D.
GLBA and FTC Regulations
E.
Patriot Act and State Money Services Acts
F.
UCC Article 4A
G.
International Payments
IV.
Europe
I.
II.
III.
IV.
V.
Market Size
Current and Pipeline Deployments
Regulatory Landscape
2012 Green Paper
Sources
2
I.A. Mobile Payments and Their Regulation
•
•
•
Mobile payments becoming increasingly common
Increasing reliance on smartphones
Gaps in the laws governing mobile financial transactions
•
•
Multiple federal and state regulators could exercise jurisdiction
Regulatory framework is complex
–
–
–
–
–
–
–
Gramm-Leach-Bliley Act (GLBA)
Fair Credit Reporting Act (FCPA)
Regulation E
Truth in Lending Act (TILA),
U.S. Patriot Act and AML requirements,
Regulation Z
Uniform Commercial Code Article 4A
3
I.B. Traditional Payments – Many Options
Consumers today have an impressive number of choices when it comes to paying for goods and services:
•
Cash
•
Checks (of various types)
•
Traditional ACH payments
– Payroll deposits
– Government disbursements
•
Credit and debit cards
– Point-of-sale (“POS”) transactions
– Transactions without a card present
• Internet
• Mail
• Telephone
•
Signature-based Card Products
– Signature-based consumer debit and credit cards are linked to and draw funds for settlement from a
line of credit extended by a card issuer
•
Prepaid cards
•
PayPal
4
I.B. Traditional Payments – Card Networks
Payment Card Networks: Private, contractual systems that provide a platform linking merchants who accept
credit cards for payment and cardholders who use them to pay for goods and services
Two types of payment systems:
•
Unitary enterprises
•
Independent network-forming companies
Unitary Enterprises (American Express):
•
Link the two sides of the payment card market directly.
•
Issue cards to cardholders and sign up merchants to accept their payment cards.
Independent network-forming companies (Visa):
•
Do not have direct relationships with cardholders and merchants
•
Link separate financial institutions into an electronic payment network
•
Relationships directly with financial institutions
•
Card-issuing banks (“Issuers”) provide network payment cards to cardholders
•
Acquiring banks (“Acquirers”) sign up merchants
5
I.C. Mobile Payments - defined
•
The Federal Reserve has defined the term “Mobile Payments” to include any “purchases, bill payments,
charitable donations, payments to another person, or any other payments made using a mobile device.”
•
Consumers can make three types of payments with a mobile device :
– Person-to-person transfers initiated from a mobile device
– Goods or services purchased over the Internet on a mobile device; and
– Point-of-sale (“POS”) payments initiated from a mobile device at a physical location.
•
Mobile Payments can be funded in a variety of ways, including:
– Purchase through a mobile carrier, either by drawing on a prepaid account with the carrier or adding the
purchase to a monthly phone bill (for example, a Red Cross text message donation);
– Charged to a traditional credit, debit or prepaid card; or
– Withdrawn directly from a bank account, typically processed over the automated clearinghouse (ACH)
system of direct electronic transfers between bank accounts.
• Consumers can consolidate multiple funding options on a mobile device through a “mobile wallet”.
Sources: Fumiko Hayashi, Mobile Payments: What’s in It for Consumers?, Federal Reserve Bank of Kansas City,
Economic Review (2012), http://www.kansascityfed.org/publicat/econrev/pdf/12q1Hayashi.pdf
6
I.C. Mobile Payments – companies & products
The New York Times reports:
“[A]n all-out war is unfolding behind the scenes to make sure you will still use your bank and
not some app or other third-party service from the likes of Google or Facebook or Apple to
make those payments five or 10 years from now.”
Companies developing mobile payment options include:
•
Isis (joint-venture between AT&T Mobility, T-Mobile USA, and Verizon Wireless)
•
Google
•
Facebook
•
Visa
•
Banks
Source: Ron Lieber, Why It’s So Hard to Transfer Cash to Your Friends, NY Times, Feb. 24, 2012, http://www.nytimes.com/2012/02/25/yourmoney/why-its-so-hard-to-transfer-cash-to-your-friends-your-money.html
7
I.C. Mobile Payments - concerns
•
•
•
•
From a regulatory point of view, transactions in which payments are applied to a phone bill
raise the greatest concern.
Interest in mobile payments reflects a technological shift that is happening now
– Technology moving faster than regulations
– Some payments processed without a separate regulated account (i.e. “Carrier Billing”)
• Users can buy goods with their phone through direct charges to their wireless carrier
• Little legal guidance on mobile payments not linked to a regulated account
Shift in participants
– Nonbanks becoming more prominent throughout the payments chain
Could result in the average consumer someday not carrying a wallet
8
I.D. Regulation of Mobile Transactions
•
Transactions processed using a traditional credit or debit card for a mobile payment
–
•
Transactions not processed through a separate regulated account (i.e., “Carrier
Billing”)
–
•
Consumer protection may not be adequately covered by regulation
Transactions involving an insured depository institution
–
•
Structure currently in place to protect consumer
Entities are regulated by Federal bank regulators
Transactions involving a telecommunications carrier
–
–
Entities are regulated by the FCC but not a financial regulator
Direct billing for purchases could subject telecommunications carriers to regulation under TILA and
EFTA
9
I.E. Mobile Statistics – Device Usage
•
Mobile phones and mobile Internet access in widespread use
– 87% of the U.S. population has a mobile phone
– 44% of mobile phones are smartphones
– 84% of smartphone users have accessed the Internet on their phone in the past wee
•
The ubiquity of mobile phones is changing the way consumers access financial
services
–
•
Mobile phones are changing the way consumers make payments
–
–
–
•
•
21% of mobile phone owners have used mobile banking in the past 12 months
12% of mobile phone owners have made a mobile payment in the past 12 months
The most common use of mobile payments was to make an online bill payment
21% of mobile payment users transferred money directly to another person’s bank, credit card or
Paypal account
Perceptions of limited usefulness and concerns about security are holding back the
adoption of mobile financial services
The “underbanked” make significant use of mobile financial services
Source: Federal Reserve – Report on “Consumers and Mobile Financial Services”
http://banking.senate.gov/public/_files/BraunsteinAddendummobiledevicereport201203.pdf
.
10
I.E. Mobile Statistics – Payment Transactions
•
•
Point-of-sale (POS) mobile payments in the U.S. lag some other industrialized
countries
No data exists on the number of U.S. consumers that have downloaded POS
payments applications, but the U.S. has far fewer POS terminals than some other
countries:
–
–
–
•
Contactless payments are a good indicator of mobile transactions
–
–
•
1 terminal per 600 people in the U.S.
1 terminal per 130 people in Japan
1 terminal per 100 people in South Korea
$22 billion in contactless payments in Japan in 2010
$1.5 billion in contactless payments in U.S. in 2009 despite larger population/economy.
But individual merchant programs have been very successful:
–
In first 11 months after Starbucks launched its mobile payment application in January 2011, consumers
made more than 26 million transactions using the application.
Source: Fumiko Hayashi, Mobile Payments: What’s in It for Consumers?, Federal Reserve Bank of Kansas City,
Economic Review (2012), http://www.kansascityfed.org/publicat/econrev/pdf/12q1Hayashi.pdf
11
I.F. Barriers to Adoption of Mobile Payments
•
•
•
Mobile transactions not widely adopted in the U.S.
Consensus is mobile payments will become a leading form of payment
Barriers to adoption include:
–
–
–
–
•
Main demand-side barrier is uncertain value of mobile payments
–
–
•
Difficulty getting industry participants to agree on technological standards;
Lack of a compelling business model for participants;
Lack of a compelling answer as to how U.S. consumers benefit from mobile payments; and
Confidence that regulation or convention will protect consumers in the event of fraud.
Some other markets had obvious advantage - in Japan as convenient way to pay for mass transit, in Africa filled gap
where consumers lacked access to other noncash payment methods
Neither of these applies broadly in the U.S., so convenience must be driving force
In U.S. need to compare mobile payments benefits to attributes of other payment forms
–
–
–
Convenience, cost, security and acceptance by merchants apply to mobile but also to other payment methods
Research shows greater convenience (mainly in POS transactions) and enhanced ability to monitor account balances are
likely to encourage use of mobile payments for in-store purchases.
Will require wider merchant acceptance of mobile payments
Source: Fumiko Hayashi, Mobile Payments: What’s in It for Consumers?, Federal Reserve Bank of Kansas City,
Economic Review (2012), http://www.kansascityfed.org/publicat/econrev/pdf/12q1Hayashi.pdf
12
I.G. Government Action on Mobile Payments
January 2010 - Federal Reserve Banks of Atlanta and Boston convene key mobile payments players to facilitate
discussion on how a successful mobile payments regime could evolve in the U.S.
•
Resulting Mobile Payments Industry Working Group meets periodically to share information & ideas
•
Reserve Banks publish paper reporting collective views on mobile payments. Calls for:
– Mobile infrastructure standards leveraging existing ACH network for non-card payments and support
new payment types
– Dynamic data authentication at heart of a layered security and fraud mitigation program
March 2012 - House and Senate Hearings on Mobile Payments
•
Hearing on “Developing the Framework for Safe and Efficient Mobile Payments,” US Senate Banking
Committee, March 29, 2012
– Kenneth Montgomery, first vice president and chief operating officer at the Federal Reserve Bank of
Boston, said “Clarity of regulatory responsibilities” among the various entities involved in the
regulation of mobile payments “needs to be established early on, with input from the mobile
stakeholders.”
13
I.G. Government Action on Mobile Payments (cont.)
March 2012 – the Federal Reserve Board published a report on mobile payment trends titled “Consumers and
Mobile Financial Services”
•
Trends in the utilization of Mobile Banking and Payments
•
Addressed mobile banking, payments and security
April 2012 – The Federal Trade Commission hosted a workshop on mobile payments and their impact on
consumers
•
recorded webcast available on the FTC website,
•
public comments available at http://www.ftc.gov/os/comments/mobilepayments/index.shtm,
•
post-workshop comments were due on June 8, 2012.
14
II.A. Traditional Payments Fraud - Types
Traditional payments governed by complex network of public laws and private card network rules.
•
Two categories of traditional payments fraud - identity theft and payment card fraud
– Identity Theft
• “Use of personal information to commit some form of fraud”
• May involve dumpster diving or phishing
• Criminal goal is to access credit or asset accounts
• 258,427 incidences recorded by FTC and other organizations in 2007
• In addition to monetary losses, consumers have opportunity cost of time spent disputing
fraudulent claims (consumers bear this cost)
– Payment Card Fraud
• Any “knowing misrepresentation of the truth… to induce another to act to his or her detriment”
• Broader and more pervasive than identity theft
• 555,472 incidences of non-identity-theft fraud recorded in 2007
• Public laws and private rules governing card payment systems generally prevent costs to
consumers
•
Public law treats access device fraud differently from other types of payment systems fraud
•
Private card network rules related to fraud are generally different for signature-based card products than for
card products based on a Personal Identification Number
15
II.A. Traditional Payments Fraud - Law
Both public law and private card network rules protect cardholders and reallocate liability for fraud losses.
•
Consumer protected by the Truth in Lending Act (“TILA”), together with Regulation Z, and the Electronic
Fund Transfer Act (“EFTA”), together with Regulation E.
– TILA protects consumers from liability for charges resulting from unauthorized use of their credit cards.
Under TILA and Regulation Z cardholder liability is capped at $50 for all unauthorized credit card
transactions, regardless of whether the fraud occurs in a single transaction or multiple transactions.
•
•
–
Cardholder has no liability for unauthorized activity after alerting the card issuer of the loss or theft of the card
“Unauthorized use” incudes both physical use of a lost or stolen card or fraudulent use of information from a
stolen card.
EFTA provides, among other things, consumer protection for the use of debit cards. EFTA and
Regulation E place a floating cap on a consumer cardholder’s liability for unauthorized debt card use
under which the maximum liability amount is determined when the cardholder notifies the card issuer
of the loss or theft of the card.
•
•
•
If the cardholder notifies the card issuer within two business days of learning of the loss or theft of the debit card,
the cardholder’s maximum liability is limited to the lesser of the actual amount of unauthorized transfers or $50.
If the cardholder fails to notify the card issuer within two business days of learning of the loss or theft, the
cardholder’s maximum liability is $500, of which only $50 can be attributable to fraud occurring during the first
two business days after the cardholder learned of the loss or theft.
If the cardholder fails to notify the card issuer of unauthorized activity within 60 days after the card issuer sends a
periodic statement reflecting the unauthorized transactions, subject to the $50 and $500 liability caps, the
cardholder has unlimited liability for fraudulent transactions occurring after the 60th day.
16
II.A. Traditional Payments Fraud – Network Rules
•
•
In addition to TILA and EFTA, there are also protections that are provided voluntarily by the private
payment systems. While TILA and EFTA allocate fraud liability from cardholders to card issuers, the
card network rules further allocate fraud liability between the card issuer and the merchant.
Card network rules enhance the baseline cardholder protections and further allocate fraud liability
from card issuers to merchants based on complicated rules that vary based on the type of
transaction,
– “Zero liability Policies” – Cardholders not responsible for any amount of transactions they did
not authorize.
– Dispute resolution rules take into account some element of the card issuer’s and merchant’s
compliance with network rules designed to detect and deter attempted fraudulent transactions.
• Allocation between card issuer and merchant depends on whether transaction was a face-to-face
transaction (“card-present”) or an Internet, mail or telephone transactions (“card-not-present”)
• In a card-not-present transaction, a merchant generally can only overcome an allegation that the
transaction was a result of fraud (and avoid liability) if the merchant (i) performed an address
verification at the time of the transaction, (ii) delivered the purchased merchandise to an address
that matches the address of the cardholder, or (iii) obtained proof that the purchased goods were
delivered to that address.
• In a card-present transaction a merchant may successfully defend a transaction disputed as
fraudulent by demonstrating that the card was present at the point of sale and producing a
signed transaction receipt, in which case the card issuer will generally be held accountable for
fraud losses.
17
II.B. Mobile Payments - Security Concerns
There are three primary security concerns present in mobile payments transactions:
• Keep information secure if the mobile phone is lost or stolen;
• Keep information secure as it is transferred from consumer to recipient; and
• Protect mobile devices from malicious software and hacking attacks.
Mobile payments have the potential to significantly reduce the likelihood of fraudulent POS
transactions.
• By facilitating dynamic authentication of the transaction at the point of sale (card authentication
has traditionally relied on static data such as card account number, expiration date, PIN or
signature. This does not change from transaction to transaction. A chip embedded in a mobile
device can enable dynamic authentication in which data unique to each transaction is used to
authenticate payment).
• Password protection of the mobile phone and of the mobile payment application on the phone
(for example, payment startup FaceCash created a mobile application that shows a photo of the
consumer to merchants).
18
II.C. Mobile Payments – Privacy Concerns
•
Mobile payments may provide more complete information about a customer, linking purchase information
with identifying information, and provide this to more parties. Under credit card transactions, no party
receives such complete information regarding the consumer and the consumer’s spending habits, unless the
consumer chooses to provide it.
•
Mobile payments “can expose consumer data to several companies that were not included in traditional
credit card transactions,” including to the mobile payment provider, the mobile network operator, and third
party apps.
•
With credit card transactions, the merchant has access to an itemized list of purchases, but generally only
receives identifying information (phone, email, address) if the customer provides that data (e.g., loyalty
programs); more merchants may have access to more information about consumers that choose to use
mobile payments.
•
If a phone number is provided to the merchant via a mobile transaction, it may qualify as an “established
business relationship” exemption for the merchant from do-not-call restrictions of the Telephone Consumer
Protection Act (TCPA).
Sources: Harley Geiger, Mobile Payments Can Expose More Consumer Data and Weaken Privacy Laws, Center for Democracy &
Technology (2012), http://www.ftc.gov/os/comments/mobilepayments/00020-82931.pdf; Chris Jay Hoofnagle, Jennifer M. Urban, &
Su Li, Mobile Payments: Consumer Benefits & New Privacy Concerns, Berkeley Center for Law & Technology (BCLT) Research Paper
(2012), http://www.ftc.gov/os/comments/mobilepayments/00021-82938.pdf.
19
II.D. Mobile Payments – Consumer Protection
Under current law consumer protection depends on the payment instrument and not whether the instrument is
used on a mobile device.
•
Credit/Debit Cards: Where a fraudulent purchase is made with a credit or debit card on a mobile device the
protections of TILA and EFTA apply, as do the applicable payment network rules.
•
Mobile Phone Bill. The only consumer protections for mobile payments linked to a mobile phone bill or
mobile prepaid account are those provided by state laws and public utility agency rules. These differ across
states and are generally weaker than federal protections against losses from fraudulent credit and debit card
payments.
•
Prepaid cards and accounts at payment intermediaries such as PayPal: Federal laws and regulations
provide the consumer little or no protection against loss or fraud regardless of whether the method is used
with a mobile device.
Surveys provide strong evidence that security matters to consumers, and that perceptions about security will
influence adoption rates:
•
Greater flexibility that mobile payments provide to consumers in choosing among payment methods may
increase consumer uncertainty about their liability for fraud losses.
20
III.A. U.S. Legal Landscape
The U.S. regulatory landscape for mobile payments transactions is complex
•
•
•
Electronic Funds Transfer Act
– Currently regulates electronic transactions
– Safeguards against unauthorized transfers
– Regulation E implemented by the Federal Reserve
Truth in Lending Act
– Covers mobile payments linked to a card or other credit account
– Regulation Z implemented by the Federal Reserve
– Mobile carriers avoid regulation by not being “credit providers” under TILA
Dodd-Frank Act
– Gave authority over EFTA and TILA to the CFPB, which also inherited several regulations from existing agencies,
including:
• Regulation E – Electronic Funds Transfers
• Regulation P – Privacy of Consumer Financial Information
• Regulation Z – Truth in Lending
– Consumer Financial Protection Board (“CFPB”) has issued a statement that it “believe[s] there may be
opportunities to streamline [these regulations] by updating, modifying, or eliminating some provisions,” and is
seeking public comments on this effort.
21
III.B. Regulators
•
Federal Reserve Board
– Implemented Regulation E and Regulation Z
– Authority for consumer protection transferred to CFPB
•
Consumer Financial Protection Bureau
– After Dodd-Frank, chief regulator for monitoring compliance by
financial providers of consumer laws
– Includes authority over mobile payments under the Dodd-Frank Act
•
Federal Trade Commission
– Retains oversight over consumer products, including with respect
to consumer protection
•
Federal Communications Commission
– Regulates telecommunications providers
– No formal lines of communications between FCC and bank
regulators
– No FCC rule specifically covers “carrier billing” transactions
22
III.C. Questions for Regulators
Core questions:
• Are new regulations needed or can existing laws governing fund transfers and credit
disclosures be adapted to cover all mobile payments?
• What regulators should have jurisdiction over mobile payments? No one regulator clearly in
charge of all mobile payments. Is coordination across multiple regulators necessary?
23
III.D. GLBA and FTC Regulations
Gramm-Leach-Bliley Act
•
Financial institutions are subject to regulatory requirements with respect to security practices under the
Financial Services Modernization Act of 1999 (“Gramm-Leach-Bliley Act”).
•
GLBA requires that financial institutions ensure the security, confidentiality and integrity of personal
information collected from customers.
•
Federal banking agencies have implemented regulations establishing a process-based approach to security
rather than a technical mandate.
•
Companies must have a written information security program overseen by the company’s Board of Directors,
with various components for identifying and assessing risks.
•
Requires a financial institution to disclose at the time it establishes its relationship with a customer, and then
annually, its policies regarding disclosure of customer’s non-public information with affiliates and nonaffiliates.
•
Must be a process for adjusting the program in light of changes in risks and vulnerabilities.
Federal Trade Commission Regulations
•
Similar security regulations to GLBA but for nontraditional financial institutions under its jurisdiction.
•
Safeguard rule is also process-based. Requires the company to designate an employee to coordinate
safeguard, identify and asses risks to customer information, to design, implement and test safeguards
program, to select service providers, and to evaluate and adjust the program.
•
FTC also has broad authority to take action against unfair and deceptive acts and practices – will charge
companies for acting unfairly by failing to provide reasonable security.
24
III.E. Patriot Act and State Regulation
USA PATRIOT Act and Anti-Money Laundering Requirements
• Designed to prevent terrorists from accessing financing
• Know-Your-Customer requirements
• FATF 40+9
State Legislation
• California S.B. 1386 – “Security Breach Information Act” - enacted in 2003; requires companies
that electronically store unencrypted personal information on a California resident to notify the
resident in the event of any unauthorized access to this information. Applies whether or not
the security breach occurs in California.
25
III.F. UCC Article 4A
Uniform Commercial Code (UCC) Article 4A
• Governs business-to-business wire transfers and automated clearinghouse payments
• Expressly excludes consumer transactions governed by the Electronic Funds Transfer Act
• Regulation E expressly excludes wire or similar business-to-business transfers from coverage
26
III.G. International Payments
Currently, the only new rule issued by the CFPB relevant to mobile payments is a Dodd-Frank amendment to
Regulation E, regarding international remittances. Under this new rule, cross-border mobile payments of $15 or
more could be deemed an international remittance, and be subject to Regulation E’s disclosure, error resolution,
cancellation, and refund procedures.
Remittance transfer: “the electronic transfer of funds requested by a sender to a designated recipient that
is sent by a remittance transfer provider. The term applies regardless of whether the sender holds an
account with the remittance transfer provider, and regardless of whether the transaction is also an
electronic fund transfer, as defined in § 1005.3(b).” [12 C.F.R. § 1005.30(e)].
Remittance transfer provider: “any person that provides remittance transfers for a consumer in the normal
course of its business, regardless of whether the consumer holds an account with such person.” [12 C.F.R.
§ 1005.30(f)].
This rule becomes effective on February 7, 2013.
27
IV.A. Europe: Market size
•
•
•
•
•
•
•
276m. payment cards used in the EU.
Online shoppers forecast to increase to 190 million by 2014.
M-payments expected to be EUR 250 bn. / year by 2014 (EC figures).
ComScore puts online banking penetration at mid-50s% in most European markets.
Smartphone penetration at 42%.
Payment cards were used for 1/3 of all non-cash retail payments in the UK (EU).
3.4% of all retail sales made by internet.
28
IV.B. Europe: current and pipeline deployments
•
•
•
•
App-to cell-number peer-to-peer payments.
Transport system contactless RFID payment e.g. Transport for London “Oyster” cards.
Gen II – The mobile wallet wars. Who will win:
– Handset makers such as Apple (IoS – iTunes extension), Chip makers? (using embedded technology)
– Carriers e.g. Vodafone, Verizon (using SMS technology)
– Google?
– VISA/MasterCard/Amex?
– New entrant?
UK
– Barclays pushing the hardest?
– Retailers: Boots (drugstore), McDonalds, and EAT/Pret (Sandwich stores).
– UK Post Office rolling out 11,500 contactless payment terminals this month.
– Samsung/VISA JV has installed 3000 contactless payment terminals across the London Olympics.
– Vodafone also teaming up with VISA PayWave.
– MasterCard “PayPass” system. American Express has launched with MBNA Europe.
– Google wallet (NFC combining payment and merchant discounts at POS)
– New “chip level” TEE system from Giesecke + Devrient, Gemalto and ARM of Cambridge.
– Intel is pushing the Atom processor Z2460, uses NXP Semiconductor’s PN65N NFC chip.
29
IV.C. Europe: regulatory landscape
•
•
•
•
•
E-Money Directive 2002
Second E-Money Directive 2009 (2EMD)
Distinguish: Payment Services Directive. E-Commerce Directive
Current landscape:
– Regulates issuing electronic money
– Establishes authorisation requirement
– Establishes prudential standards
– Prohibits payment of interest
– Exempted “limited networks” e.g. transport system payment cards
– Prohibits time limits/time expiry
Problems (as seen by the Commission)
– Payment card systems still largely developed within national borders
– Opaque Multilateral Interchange Fees (MIFs).
– Payment issues are mentioned by consumers and merchants as the reason for non take-up of ecommerce.
– Lack of cross-border technical standardisation.
30
IV.D. Europe: 2012 Green Paper
•
•
•
•
Consultation on five issues/themes:
– Market access and entry for existing and new providers
– Payment security and data protection
– Transparent and efficient pricing
– Technical standardisation
– Inter-operability between service providers
Questions
– Are payments sufficiently secure? What are the gaps?
– Should two factor authentication be used?
– Should payment security be underpinned by a regulatory framework?
– If there is a trade-off between interoperability and fragmentation/greater innovation, which should be
preferred?
– What are the most appropriate mechanisms to ensure protection of personal data?
Next steps
Recommendations
31
V. Sources
Hearing on “Developing the Framework for Safe and Efficient Mobile Payments,” U.S. Senate Banking Committee, March 29, 2012
•
Testimony from Federal Reserve, Director of the Division of Consumer and Community Affairs
http://banking.senate.gov/public/index.cfm?FuseAction=Files.View&FileStore_id=35f312df-40b9-4305-b400-97939358ad54
•
Federal Reserve – Report on “Consumers and Mobile Financial Services”
http://banking.senate.gov/public/_files/BraunsteinAddendummobiledevicereport201203.pdf
•
Testimony from Chie Operating Officer of the Federal Reserve Bank of Boston
http://banking.senate.gov/public/index.cfm?FuseAction=Files.View&FileStore_id=df78b433-fdc2-47b7-b240-1fa061575669
Articles
•
Duncan B. Douglass, An Examination of the Fraud Liability Shift in Consumer Card-Based Payment Systems, Federal Reserve
Bank of Chicago, Economic Perspectives (2009),
http://wwws.chicagofed.org/digital_assets/publications/economic_perspectives/2009/ep_1qtr2009_part7_douglass.pdf
•
Harley Geiger, Mobile Payments Can Expose More Consumer Data and Weaken Privacy Laws, Center for Democracy &
Technology (2012), http://www.ftc.gov/os/comments/mobilepayments/00020-82931.pdf
•
Fumiko Hayashi, Mobile Payments: What’s in It for Consumers?, Federal Reserve Bank of Kansas City, Economic Review (2012),
http://www.kansascityfed.org/publicat/econrev/pdf/12q1Hayashi.pdf
•
Chris Jay Hoofnagle, Jennifer M. Urban, & Su Li, Mobile Payments: Consumer Benefits & New Privacy Concerns, Berkeley
Center for Law & Technology (BCLT) Research Paper (2012), http://www.ftc.gov/os/comments/mobilepayments/0002182938.pdf
•
Michael Klein & Colin Mayer, Mobile Banking and Financial Inclusion: The Regulatory Lessons, The World Bank, Policy Research
Working Paper 5664 (2011), http://wwwwds.worldbank.org/external/default/WDSContentServer/IW3P/IB/2011/05/18/000158349_20110518143113/Rendered/PDF/
WPS5664.pdf
•
Mark MacCarthy, Information Security Policy in the U.S. Retail Payments Industry, Stanford Technology Law Review (2011),
http://stlr.stanford.edu/pdf/maccarthy-information-security-in-retail-payments.pdf
32
V. Sources (cont.)
Articles (cont.)
•
Suzanne Martindale & Gail Hillebrand, Pay at Your Own Risk? How to Make Every Way to Pay Safe for Mobile Payments,
Banking & Finance Law Review (2011), http://ssrn.com/abstract=1787587
•
Jan Ondrus & Kalle Lyytinen, Mobile Payments Market: Towards Another Clash of the Titans?, Tenth International Conference
on Mobile Business (2011), http://www.janondrus.com/wp-content/uploads/2008/05/ICMB2011.pdf
•
Colin C. Richard, Mobile Remittances and Dodd-Frank: Reviewing the Effects of the CFPB Regulations, Pittsburgh Journal of
Technology Law & Policy (2012), http://tlp.law.pitt.edu/ojs/index.php/tlp/article/view/99/106
•
Colin C. Richard, Dodd-Frank, International Remittances, and Mobile Banking: The Federal Reserve’s Role in Enabling
International Economic Development, Northwestern University Law Review Colloquy (2011),
http://www.law.northwestern.edu/lawreview/colloquy/2011/7/LRColl2011n7Richard.pdf
•
Lydia Segal, Benjamin Ngugi, & Jafar Mana, Credit Card Fraud: A New Perspective on Tackling an Intransigent Problem, Fordham
Journal of Corporate & Financial Law (2011) [available on LexisNexis]
•
Stuart E. Weiner, The Federal Reserve’s Role in Retail Payments: Adapting to a New Environment, Federal Reserve Bank of
Kansas City, Economic Review (2008), http://www.kc.frb.org/publicat/ECONREV/PDF/4q08weiner.pdf
Recent News
•
Ron Lieber, Why It’s So Hard to Transfer Cash to Your Friends, NY Times, Feb. 24, 2012,
http://www.nytimes.com/2012/02/25/your-money/why-its-so-hard-to-transfer-cash-to-your-friends-your-money.html
•
Somini Sengupta, The Post-Cash, Post-Credit-Card Economy, NY Times, April 28, 2012,
http://www.nytimes.com/2012/04/29/sunday-review/the-post-cash-post-credit-card-economy.html
33
<Presentation Title/Client Name>
Professional Profiles
Lois F. Herzeca
Contact:
200 Park Avenue
New York, NY 10166-0193
Tel: 212.351.2688
[email protected]
Lois F. Herzeca is a partner in the New York office of Gibson, Dunn & Crutcher. Ms. Herzeca is Co-Chair of the firm’s Fashion, Retail
and Consumer Products Practice Group.
Ms. Herzeca advises public and private companies, and investment banks, on significant legal and business matters, including
mergers and acquisitions, capital market transactions, commercial agreements, and joint ventures. Although she counsels
companies in a wide range of industries, she specializes in the fashion, retail and apparel industries.
Her fashion industry clients have included Helmut Lang, Proenza Schouler, Brian Atwood, L’Wren Scott, Rachel Zoe and Tabitha
Simmons.
Ms. Herzeca was named a “Dealmaker of the Year” by The American Lawyer in 2012. She is ranked as a leading lawyer by Chambers
USA: America’s Leading Lawyers for Business and is one of Avenue Magazine’s “Top Women Lawyers” in New York City.
She has written more than 30 articles for legal and financial publications including BNA, Bloomberg Law Reports: Corporate
Governance, New York Law Journal, Director's Monthly, The Corporate Governance Advisor, The M&A Lawyer, D&O Advisor, Best's
Review, The Business Lawyer, Mergers and Acquisitions in Canada, National Underwriter, and The Deal. She has also spoken at
conferences for the Practising Law Institute, MergerMarket, the Strategic Research Institute and The Conference Board. Ms. Herzeca
has been quoted extensively in such publications as The Wall Street Journal, Law 360, The AmLaw Daily, Invesment Dealers Digest,
and The New York Law Journal.
Ms. Herzeca earned her Juris Doctor cum laude from the Boston University School of Law. In 2009, Boston University honored her
with an Alumni Pro Bono award recognizing her many community-based and international pro bono initiatives. She is a board
member of Women In Need, Volunteers of Legal Service and Women in Law Empowerment Forum.
34
<Presentation Title/Client Name>
Professional Profiles
James Barabas
Contact:
Telephone House
2-4 Temple Avenue
London EC4Y 0HB
Tel: +44 (0)20 7071 4253
[email protected]
James Barabas is an English qualified partner in the London office of Gibson, Dunn & Crutcher and a member of the firm's
Corporate Transactions Practice Group.
Mr. Barabas has extensive experience in corporate transactions including acquisitions, mergers, outsourcings, and joint
ventures. He also regularly advises companies on governance matters.
Mr. Barabas works across a variety of sectors including TMT, financial institutions, real estate, retail, and general industrial.
He is recommended in the field of Corporate/M&A by UK Legal Experts 2011 and in M&A by UK Legal 500 2010.
Prior to joining Gibson, Dunn & Crutcher in 2006, Mr. Barabas practised for eight years with Freshfields Bruckhaus Deringer in
London.
Education
Durham University, B.A. (Hons.) Law, 1994
Dissertation: The use of copyright laws to protect software innovation
35
<Presentation Title/Client Name>
Professional Profiles
Kimble C. Cannon
Contact:
333 South Grand Avenue
Los Angeles, CA 90071-3197
Tel: 213.229.7084
[email protected]
Kimble Charles Cannon is of counsel in the Los Angeles and Washington DC offices of Gibson, Dunn & Crutcher and a
member of the firm's Corporate Transactions and Financial Institutions Groups.
Prior to joining Gibson Dunn, Mr. Cannon was an investment banker with Morgan Stanley & Co., where he was involved in
transaction execution and corporate finance coverage of financial, media and consumer-retail companies. As a banker he
advised clients with respect to initial public offerings, debt & equity issuances and mergers & acquisitions.
Mr. Cannon was formerly an attorney at the U.S. Securities and Exchange Commission where he was Counsel to
Commissioner Paul S. Atkins and Senior Counsel in the Division of Enforcement. Prior to his tenure at the SEC, Mr. Cannon
was a corporate attorney in private practice in Washington DC and the founder of a media company resident in China.
Mr. Cannon graduated from Duke University and received his J.D. from Columbia University Law School, where he was a
Harlan Fisk Stone Scholar. He has published widely on corporate and securities law matters and received his M.B.A. from the
Wharton School at the University of Pennsylvania, concentrating in finance.
36