Most customers could care less whether they enter their 4-digit PIN or sign a sales draft when using their Visa or MasterCard logoed debit card (“check card”) to make a purchase. The price they pay for goods or services is the same either way.
But the customer’s mode of choice has had a material impact on the cost of the transactions to merchants – at least until recently. For those merchants that have “interchange-plus” agreements with their banks, allowing for pass-through debit network costs, PIN-debit transactions historically have cost far less than if the same transaction was processed as Signature-debit – i.e. with no PIN validation. As recently as two years ago, the cost of PIN-debit was as little as half that of a Signature-debit transaction, depending upon the sale amount, merchant type and other factors.
The PIN advantage always was particularly pronounced for merchants selling higher-than-average priced goods and services, i.e. items priced above $40-$50 or so. That was because the debit networks charged more in transaction fees than, say, credit card transactions (about double), but at least they always “capped” the percentage assessed on the sale amount for most transactions. There was a maximum fee for the most common types of transactions no matter what the ticket size. So, an average retail PIN-debit transaction often would cost no more than 60 or 70 cents all-in.
This was not so for a Signature-debit transaction, however. Signature-debit was priced like credit card transactions, with fees more or less proportion to the price of the merchandise or services.
The gradual tectonic shift in debit card pricing strategy over the years turned into a tremor felt throughout the payments industry in 2009 when Discover’s PULSE network (the third largest) removed its fee cap on most types of PIN-debit transactions. The Pulse percentage fee now floats with the ticket size for standard transaction types. Since then, the other major EFT networks – Star (First Data Corp.), NYCE (Metavante), Accel/Exchange (FiServ) and CU-24 – have followed suit and have eliminated or moved-up the caps on the most common PIN-debit transactions.
The final and most influential change just occurred in April 2010. As part of Visa’s semi-annual interchange modifications, Visa raised the Interlink interchange rate for PIN-debit pricing from 75 basis points and $.17 per transaction to 95 basis points and $0.20 for standard transactions. Visa PIN and Signature pricing are now the same. Considering that Visa’s Interlink debit network has a 40%+ share of the debit card market and that it processes an estimated 73% share of all Signature-debit transactions, the practical impact of Visa’s change to merchants is likely to be profound.
Rate strategies vary and the devil is in the comparative pricing details between networks and transaction or industry categories. So, there still can be found certain price advantages for PIN-debit for some industries and in some ticket-size scenarios. However, there no longer is a noticeable safe haven price gap between PIN and Signature to be exploited. That is particularly counter-intuitive considering processing rates traditionally have had some relationship to transaction financial risk; PIN-validated transactions have been viewed as inherently less prone to repudiation, thus less risky to the account holders and banks involved than transactions with signature verification.
Many merchants are resigning themselves to the new reality in which Signature-debit reigns supreme. With little price advantage remaining between PIN and Signature, major industries like pay-at-the-pump fuel operations are seriously are debating whether to make the estimated $20,000 per location investment required to convert current PIN acceptance devices to a new generation of more secure PIN data devices as mandated by the PCI Security Standards Council Data Security Standards . It even remains to be seen whether Cosco, Home Depot, Wal-Mart and other mega-merchants that, due to the price differential of Signature-debit, have not even offered Signature-debit as an option to POS debit customers, will soon do away with PIN-pads.
Major check card issuing banks have been actively promoting Signature-debit in promotional mailings to their cardholders. They have offered incentives on purchases that only apply when a Signature-debit transaction is made. JPMorganChase, according to news reports, has made the inaccurate inference to its cardholders that Signature-validated transactions are somehow more secure than PIN transactions. Presumably they are promoting Signature over PIN debit because they make back more money, as card issuers, from the resulting Interchange fees being paid when a Signature-debit transaction is processed via the credit card networks, rather than when a PIN-debit transaction is processed by one of the Electronic Funds Networks (“EFT”) networks. Now, that difference has been largely negated so there is little need to promote Signature-debit per se.
What is causing the major strategy shift by the EFT networks and Visa? It is all part of the overarching competition between networks to woo financial institutions to issue cards processed by their networks. The networks make money on the transaction processing (“switch”) fees assessed to every transaction that occurs (from about 3¢ to as much as 8¢ for PIN-debit, depending on the network). The majority of the fees charged to the merchant – per transaction and per sales dollar – are paid to the card issuing bank. So what we have been seeing is essentially a bidding war among the networks to get their brand “bugs” printed on the back of the most cards issued.
Having said that, it is not at all obvious yet just how much of a shift in real fee income will come from all this market re-positioning and effective price parity between PIN and Signature-debit. Debit cards have become more and more popular in recent years, especially during the recession. Debit now surpasses credit as the preferred means of POS payment. But debit cards, in whatever format, still are essentially plastic checks, with more or less the same consumer behavior patterns as cash. As such, debit transactions might be more common than credit card transactions, but the dollar volume of debit is far from matching total credit card purchase volumes. Understandably, debit purchases are limited to bank account balances. Higher value goods and services continue to be purchased on credit – although less credit is being extended during the recession. According to a 2009 PULSE study, the average pin debit transaction in 2008 was about $42 for PIN-debit compared to $37 for Signature-debit. PULSE estimated more a quarter of all debit transactions in 2008 were for purchases of less than $10. This compares to average retail credit card purchase amounts that are usually approximated to be about $70-$80.
Processing cost is the paramount issue to most merchants, yet there still are several soft reasons for reasons for a continue acceptance of PIN-debit transactions:
- Customers often are more comfortable with the security of PIN validation. After all, the card is accessing their bank account. Presumably, only the card owner knows and uses the PIN.
- There are many consumers without credit cards, or who have reached their limits. PIN and Signature-debit let the customer make a cash-less purchase with the funds they have in their bank account but happen not to have in their wallet.
- For the merchant, funds process through the EFT networks almost immediately. By contrast, a Signature-debit transaction, run through the credit card networks, might take 2-3 days to be debited from the consumer’s account. This can mean less chance of insufficient funds and sometimes faster credit of sale proceeds to merchants.
- PIN transactions typically can be completed faster in the check-out line and require less documentation and storage by the merchant. A PIN-debit transaction has considerably less chance of being repudiated successfully.
- A PIN-debit transaction allows for cash-back to the cardholder at the POS; this is not possible with a Signature-debit transaction.
Even so, much the appeal of a PIN transaction is proves to be somewhat illusory:
? While true that PIN-authentication is relatively fool-proof security for a specific transaction, the card remains vulnerable as long there is a Visa or MasterCard logo on the card and the card can be alternatively tendered for a Signature-debit transaction. Signatures or IDs, obviously, are not always verified by store clerks.
- Both PIN-debit and Signature-debit cards benefit from consumer protection laws and practices, although the protections come from different laws. If reported lost or stolen in a timely manner, the cards have a maximum of $50 liability to the account holder.
- PIN-debit transactions usually do not accrue rewards credits from the issuing banks, whereas Signature-debit cards do. This feature, alone, is accelerating the shift from PIN to Signature.
There is little merchants can do to shape the system to their benefit. Merchants are under contractual obligations by their acquiring bank sponsors to accept all cards with a Visa or MasterCard logo. They are prohibited from attempting to “steer” a customer card transaction from one mode of acceptance to another. Card company rules further require merchants with PIN-processing capability to proactively provide customers the choice of making a PIN-debit or Signature-debit transaction. At best, merchants can only make the threshold decision to either enable acceptance of PIN-debit by making a PIN-pad available at the POS or to accept only Signature-debit transactions at the POS.
Written By: Charles S. Crawford, Executive Vice President for Strategic Development
Electronic Payment Exchange
EPX Welcomes Third-Party Validations of Tokenization and Payment Processing Outsourcing
Tuesday, July 20th, 2010Editor’s Note: It’s always encouraging to see EPX competitors follow in our footsteps. Just as competitors are following our lead by touting the benefits of tokenization technology, several competitors are even beginning to issue press releases that mirror ours. I guess imitation is the sincerest form of flattery.
Electronic Payment Exchange (EPX), a full-service payment processing organization, announced today that their organization welcomes the recent third-party validations of cardholder data tokenization and payment processing outsourcing. Newly announced global industry best practices for tokenization from Visa Inc. validate EPX’s long-standing deployment of tokenization technology for securing cardholder data. Additionally, a June 2010 security brief from RSA supports EPX’s approach to tokenized payment processing outsourcing by referencing an EPX client case study that shows how tokenization and payment processing outsourcing reduce merchant costs and other burdens associated with securing cardholder data.
The recent release of Visa’s tokenization best practices provides valuable guidance to merchant organizations seeking to utilize tokenization solutions for securing cardholder data. As the first organization in the payments industry to engineer and deploy tokenization technology, EPX welcomes Visa’s focus on and validation of tokenization solutions.
In version 1.0 of the Visa Best Practices for Tokenization document, Visa establishes best practices related to four critical components of tokenization: token generation, token mapping, card data vault, and cryptographic key management. Visa provides further recommendations regarding tokenization system configuration, implementation, and management, and offers guidance on the management of historical data.
EPX, which has offered merchants tokenization technology since 2001, abides by one hundred percent of the best practices established by Visa and views the best practices as reinforcement of EPX’s approach to tokenization. According to EPX Chief Security Officer Matt Ornce, “Visa is now confirming what we have been saying and practicing for years. Merchants that properly implement a sound tokenization solution are able to limit cardholder data storage in their environments. In turn, this simplifies merchant PCI DSS assessments by reducing the scope of their compliance requirements, associated costs, and implementation. This makes merchants of any size more secure and brings them into compliance easier, faster, and with less expense.”
Further validating EPX’s approach to payment data security, a June 2010 security brief released by RSA provides insight into how tokenization can be combined with payment processing outsourcing to relieve merchants of the burden and potential costs associated with securing cardholder payment data. Using an EPX client who annually processes tens of thousands of ecommerce transactions as an example, RSA pointed out that the merchant organization substantially reduced its PCI compliance burden. The security brief also establishes that, over the next several years, many payment processing organizations will introduce outsourced payment services to manage cardholder data risks on behalf of merchants. The brief provides additional insight by stating that the most effective outsourced payment services will use a combination of tokenization and encryption.
EPX has provided payment card security outsourcing for ten years and was the first payment processor to actually market, sell, and implement a solution that uses both tokenization and encryption for securing card data from the card swipe through the entire transaction lifecycle. By processing through EPX, individual merchants have reduced their initial PCI compliance burden by millions of dollars and continue to realize significant annual savings.
EPX welcomes the third-party validation of payment processing outsourcing and the use of tokenization plus encryption technologies. “It is great to see that leaders in the payments and security industries are recognizing EPX’s accomplishments,” EPX Chief Executive Officer Ray Moyer said.
Tags: BuyerWall, credit card processing, credit card processor, data breach, debit card processing, Electronic Payment Exchange, encryption, end-to-end encryption, EPX, matt ornce, payment processing, PCI compliance, PCI DSS, tokenization, VISA, VISA best practices
Posted in EPX Commentary, EPX News, Payments Industry News | No Comments »